TP-Link VX800v Improper Link Resolution Vulnerability in USB HTTP Access Path Allowing Unauthorized Read-Only Access to System Files

A vulnerability in the TP-Link VX800v router, specifically in version 1.0, has been identified that allows a crafted USB device to exploit improper link resolution in the USB HTTP access path. This exploitation gives an attacker with physical access read-only access to the root filesystem, enabling them to view system files. The vulnerability arises from the router's failure to properly validate links in the USB access path, allowing unauthorized access to sensitive filesystem contents.

Impact

Exploitation of this vulnerability leads to unauthorized read-only access to the root filesystem, allowing exposure of system files to an attacker with physical access.

Remediation

Users are advised to update to the latest firmware version. The VX800v firmware can be downloaded from the TP-Link support page for this product.