A dangerous bug has been discovered in TP-Link Archer routers, which allows unauthorized login without passwords and with administrator rights. Those who own such a router should upgrade their device immediately.
TP-Link has a critical vulnerability in certain models of its Archer routers that could allow attackers to override administrator passwords and remotely gain full control of the devices via LAN and Telnet connection.
According to IBM X-Force Red researcher Grzegorz Wypych , if attackers send these routers an HTTP request containing a character string longer than the allowed number of bytes, the result will be the user password being completely invalidated and replaced with an empty value.
This works despite built-in validation because it only checks the referrer HTTP headers, allowing the attacker to trick the router's httpd service into recognizing the request as valid using the hardcoded value tplinkwifi.net .
Since the only type of user on these routers is the administrator with full root privileges, once attackers bypass the authentication process, they will automatically gain administrator privileges on the router.
Accordingly, the legitimate user will be locked out and will no longer be able to log in to the router with their passwords. The scenario gets even worse, since even if the router owner manages to hard reset and set a new password on the device, attackers could still override it with another LAN request.
This flaw is considered critical, as it could grant unauthorized third-party access to the router with administrative privileges. The risk is of course greater in business networks, where routers like these are used to provide Wi-Fi access to guests.
Security patches available
TP-Link has already released updates to help customers protect their routers from attacks that could exploit this security vulnerability, which is called CVE-2019-7405.
You can download the security updates for the Archer C5 V4, Archer MR200v4, Archer MR6400v4, and Archer MR400v3 routers from the table below.
| Vulnerable TP-Link router | Security update |
| Archer C5 V4 | https://static.tp-link.com/2019/201909/20190917/Archer_C5v4190815.rar |
| Archer MR200v4 | https://static.tp-link.com/2019/201909/20190903/Archer%20MR200(EU)_V4_20190730.zip |
| Archer MR6400v4 | https://static.tp-link.com/2019/201908/20190826/Archer%20MR6400(EU)_V4_20190730.zip |
| Archer MR400v3 | https://static.tp-link.com/2019/201908/20190826/Archer%20MR400(EU)_V3_20190730.zip |
