{"id":1612,"date":"2025-01-29T10:10:02","date_gmt":"2025-01-29T10:10:02","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/01\/29\/poc-exploit-released-for-tp-link-router-web-interface-xss-vulnerability\/"},"modified":"2025-01-29T10:10:02","modified_gmt":"2025-01-29T10:10:02","slug":"poc-exploit-released-for-tp-link-router-web-interface-xss-vulnerability","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/01\/29\/poc-exploit-released-for-tp-link-router-web-interface-xss-vulnerability\/","title":{"rendered":"PoC Exploit Released for TP-Link Router Web Interface XSS Vulnerability"},"content":{"rendered":"<p>    PoC Exploit Released for TP-Link Router Web Interface XSS Vulnerability<br \/>\n \t<BR><br \/>\n<BR><\/BR><br \/>\n    <!-- no image --><br \/>\n \t<BR><br \/>\n<BR><\/BR><\/p>\n<div>\n<p>A Cross-Site Scripting (XSS) vulnerability has been identified in the TP-Link Archer A20 v3 router, specifically in firmware version 1.0.6 Build 20231011 rel.85717(5553).\u00a0<\/p>\n<p>The issue stems from improper handling of directory listing paths on the router\u2019s web interface. When a specially crafted URL is accessed, the router renders the directory listing and executes arbitrary JavaScript embedded in the URL.\u00a0<\/p>\n<p>This flaw allows attackers to inject malicious scripts into the page, potentially enabling further exploitation on a victim\u2019s browser. The vulnerability has been classified as CVE-2024-57514 and has a Medium severity CVSS of 4.0.\u00a0\u00a0<\/p>\n<p>Researcher Ravindu Wickramasinghe (@rvizx9) disclosed this issue, emphasizing its potential for misuse in targeted attacks.<\/p>\n<h2 class=\"wp-block-heading\">\n<strong>PoC Exploit Released <\/strong>\u2013 <strong>CVE-2024-57514<\/strong><br \/>\n<\/h2>\n<p>The vulnerability resides in the web interface\u2019s \/ path and its subdirectories, where improperly sanitizing directory listing paths allows JavaScript injection.<\/p>\n<p class=\"has-text-align-center has-background\" style=\"background:linear-gradient(180deg,rgb(238,238,238) 93%,rgb(169,184,195) 100%)\"><strong>Are you from SOC\/DFIR Teams? \u2013\u00a0Analyse Malware Files &amp; Links with ANY.RUN Sandox -&gt;\u00a0<a href=\"https:\/\/any.run\/demo\/?utm_source=li_csn&amp;utm_medium=post&amp;utm_campaign=video_meme&amp;utm_content=demo&amp;utm_term=270125\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Try for Free<\/a><\/strong><\/p>\n<p>However, due to the cookie path attribute scoped to \/cgi-bin\/luci, cookies related to this path remain inaccessible to attackers leveraging this <a href=\"https:\/\/cybersecuritynews.com\/patch-for-xss-vulnerability-in-file-rendering\/\" target=\"_blank\" rel=\"noreferrer noopener\">XSS vulnerability<\/a>.\u00a0<\/p>\n<p>While direct cookie theft is mitigated, other attack vectors, such as session hijacking or phishing, remain plausible depending on the broader system context.<\/p>\n<figure class=\"wp-block-video\"><video controls src=\"https:\/\/www.zyenra.com\/videos\/dcd504e9709cb69f895b0d2d51c5b5c6f20ca5212e5a1bd288ae7dfa3ee72ad1\/poc.webm\"><\/video><\/figure>\n<p>By embedding such a script into a specially crafted URL, an attacker can force the router\u2019s web interface to <a href=\"https:\/\/cybersecuritynews.com\/hpe-aruba-network\/\" target=\"_blank\" rel=\"noreferrer noopener\">execute arbitrary code<\/a> within a victim\u2019s browser.<\/p>\n<p>TP-Link has acknowledged the existence of this vulnerability but has stated that the Archer A20 v3 router has reached its End-of-Life (EOL) status under their End-of-Life Policy. Consequently, no patches or corrective actions will be issued for this model.\u00a0<\/p>\n<p>The company assured users that they are actively reviewing other models for potential vulnerabilities and implementing necessary security measures.<\/p>\n<h2 class=\"wp-block-heading\"><strong>Security Implications<\/strong><\/h2>\n<p>While the XSS vulnerability is rated as medium severity, it underscores risks associated with unpatched legacy devices. Attackers could exploit this flaw to:<\/p>\n<ul class=\"wp-block-list\">\n<li>Execute malicious scripts on users\u2019 browsers.<\/li>\n<li>Redirect victims to phishing sites or download malware.<\/li>\n<li>Conduct reconnaissance for further exploitation.<\/li>\n<\/ul>\n<p>Given that no patch will be provided due to EOL status, affected users are advised to:<\/p>\n<ul class=\"wp-block-list\">\n<li>Replace outdated routers with supported models.<\/li>\n<li>Restrict access to the router\u2019s web interface using firewall rules.<\/li>\n<li>Avoid clicking on suspicious URLs related to the router\u2019s interface.<\/li>\n<\/ul>\n<p>The disclosure of CVE-2024-57514 highlights ongoing challenges in securing IoT devices like routers, especially those no longer receiving <a href=\"https:\/\/www.zyenra.com\/blog\/xss-in-tplink-archer-a20.html\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">updates<\/a>.\u00a0<\/p>\n<p>Users must adopt proactive measures to mitigate risks associated with unpatched vulnerabilities, while manufacturers should prioritize transparency and support for legacy devices.<\/p>\n<p class=\"has-text-align-center has-background\" style=\"background:linear-gradient(180deg,rgb(238,238,238) 92%,rgb(169,184,195) 100%)\"><strong><strong>Integrating Application Security into Your CI\/CD Workflows Using Jenkins &amp; Jira -&gt;\u00a0<a href=\"https:\/\/webinars.indusface.com\/agile-security-workflows-devsecops-hacks-for-ci-cd-pipeline\/register?utm_source=gbhackers-blog-cta&amp;utm_campaign=2025-jan-webinar-agile-security&amp;utm_medium=referral\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Free Webinar<\/a><\/strong><\/strong><\/p>\n<p>The post <a href=\"https:\/\/cybersecuritynews.com\/poc-exploit-tp-link-router-web-interface\/\">PoC Exploit Released for TP-Link Router Web Interface XSS Vulnerability<\/a> appeared first on <a href=\"https:\/\/cybersecuritynews.com\/\">Cyber Security News<\/a>.<\/p>\n<\/div>\n<p> \t<BR><br \/>\n <BR><\/BR><br \/>\n    Guru Baran<br \/>\n \t<BR><br \/>\n<BR><\/BR><br \/>\n<a href=\"https:\/\/cybersecuritynews.com\/poc-exploit-tp-link-router-web-interface\/\">Go to cyber-security-news<\/a><br \/>\n \t<BR><br \/>\n <BR><\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"<p>PoC Exploit Released for TP-Link Router Web Interface XSS Vulnerability A Cross-Site Scripting (XSS) vulnerability has been identified in the TP-Link Archer A20 v3 router, specifically in firmware version 1.0.6 Build 20231011 rel.85717(5553).\u00a0 The issue stems from improper handling of directory listing paths on the router\u2019s web interface. When a specially crafted URL is accessed, [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[657,129,63,131],"tags":[130],"class_list":["post-1612","post","type-post","status-publish","format-standard","hentry","category-browser","category-cyber-security","category-cyber-security-news","category-vulnerability","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/1612"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=1612"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/1612\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=1612"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=1612"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=1612"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}