TP-Link Router Flaw CVE-2023-28760 Allows Root RCE via LAN, PoC Available

Security researchers have highlighted a critical flaw in the TP-Link AX1800 family (Archer AX21/AX20) that could allow unauthenticated attackers on the LAN to achieve remote code execution as root via the MiniDLNA service, tracked as CVE-2023-28760 and rated CVSS 7.5 (High).

The vulnerability stems from improper bounds checking in minidlna-1.1.2/upnpsoap.c, enabling an attacker to modify the files[.]db database used by the USB-shared Media Sharing feature and potentially trigger a stack-based overflow that leads to RCE. The issue can be exploited when a USB storage device is connected and the shared USB drive exposes a path such as /mnt/sda1/.TPDLNA, with the attack progressing through a crafted dlna_pn field to overflow a fixed-size stack buffer.

A full PoC exploit demonstrated at the Pwn2Own competition achieved a remote interactive shell on the router, confirming the exploit’s feasibility, according to security researchers including Rocco Calvi and the CVE Records. TP-Link was notified under coordinated disclosure and the fix arrived in firmware version Archer AX20(EU)_V3_1.1.4 Build 20230219; users are advised to upgrade, with the latest firmware and instructions available from TP-Link.