Talos Vulnerability Report

SUMMARY

A post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CONFIRMED VULNERABLE VERSIONS

The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.

Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591

PRODUCT URLS

ER7206 Omada Gigabit VPN Router - https://www.tp-link.com/us/business-networking/vpn-router/er7206/

CVSSv3 SCORE

7.2 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)

DETAILS

The ER7206 Omada Gigabit VPN Router is a high-performance networking solution that supports gigabit connectivity, highly secure VPN and integration with Omada SDN for centralized cloud management and zero-touch provisioning.

The ER7206 Omada Gigabit VPN Router runs various services to manage the router or devices connected to the router. One such service is uhttpd which runs on port 80/443. It gives users a web interface to configure and manage the router. By default, the service runs as a root user. An attacker can gain root access to the device by exploiting this service.

A command injection vulnerability exists in the uhttpd service when setting up the PPTP global config. In the web interface, the PPTP global config page can be accessed by navigating to VPN -> PPTP -> Global Config. It contains PPTP Hello Interval, PPP Hello Interval and NetBios Passthrough parameters. When the PPTP global config is saved, it triggers the following HTTP Post request:

POST /cgi-bin/luci/;stok=af5c1dae59be3d7360aa3bfb48af98fc/admin/pptp_global?form=global HTTP/1.1
Host: 192.168.8.100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-CA,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 227
Origin: http://192.168.8.100
Connection: close
Referer: http://192.168.8.100/webpages/index.html
Cookie: sysauth=846e8e5aeae69f3b28f7caebce4bcd80

data=%7b%22method%22%3a%22set%22%2c%22params%22%3a%7b%22pptphellointerval%22%3a%2260%60id%3e%2ftmp%2ff%60%22%2c%22lcpechointerval%22%3a%2260BB%22%2c%22netbios_passthrough%22%3a%22off%22%2c%22vpn_to_internet%22%3a%22off%22%7d%7d

The PPTP Hello Interval and PPP Hello Interval parameters are vulnerable to the command injection vulnerbaility. They are used as a arguments to a shell command without any sanitization. An attacker, by including shell metacharacters in the pptphellointerval or lcpechointerval parameter, can manipulate the executed command and introduce unauthorized commands, which leads to the command injection vulnerability. Even though administrative access is required to trigger this vulnerability, it can be used to acquire an unrestricted shell access to the device.

VENDOR RESPONSE

The vendor released a new firmware available at: https://www.tp-link.com/us/support/download/er7206/v1/#Firmware

TIMELINE

2023-12-04 - Initial Vendor Contact
2023-12-05 - Vendor Disclosure
2024-02-01 - Vendor Patch Release
2024-02-06 - Public Release