CVE-2024-54887
Published: 09 January 2025
Summary
CVE-2024-54887 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Tp-Link Tl-Wr940N. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked in the top 19.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 mandates identification, reporting, and correction of the buffer overflow flaw via firmware updates, directly eliminating CVE-2024-54887.
SI-10 requires validation of information inputs like dnsserver1 and dnsserver2 parameters, preventing the buffer overflow in the Wan6to4TunnelCfgRpm.htm handler.
SI-16 enforces memory protections such as DEP or stack canaries to block arbitrary code execution resulting from the buffer overflow.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow vulnerability in the web management interface (/userRpm/Wan6to4TunnelCfgRpm.htm) via dnsserver parameters allows authenticated remote code execution as root, enabling Exploitation of Remote Services.
NVD Description
TP-Link TL-WR940N V3 and V4 with firmware 3.16.9 and earlier contain a buffer overflow via the dnsserver1 and dnsserver2 parameters at /userRpm/Wan6to4TunnelCfgRpm.htm. This vulnerability allows an authenticated attacker to execute arbitrary code on the remote device in the context of…
more
the root user.
Deeper analysisAI
CVE-2024-54887 is a buffer overflow vulnerability (CWE-120) in TP-Link TL-WR940N V3 and V4 routers running firmware version 3.16.9 and earlier. The flaw occurs in the handling of the dnsserver1 and dnsserver2 parameters on the /userRpm/Wan6to4TunnelCfgRpm.htm webpage, which can be triggered to overwrite memory boundaries.
An attacker with low privileges (PR:L) who is adjacent to the device on the network (AV:A) can exploit this with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation enables arbitrary code execution in the context of the root user, granting high impacts on confidentiality, integrity, and availability (CVSS:3.1 score of 8.0).
Advisories and additional details are referenced at http://tp-link.com and https://github.com/JBince/vulnerability-research/tree/main/CVE-2024-54887, which include vulnerability research and likely mitigation guidance from the vendor.
Details
- CWE(s)