TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9 Authenticated Remote Command Execution Vulnerability

An authenticated remote command execution vulnerability has been identified in the Parental Control page of TP-Link Archer C7(EU) V2 routers prior to version 241108, and TL-WR841N/ND(MS) V9 routers also prior to version 241108. This vulnerability allows attackers to execute commands remotely on the affected devices.

Impact

Exploitation of this vulnerability allows for authenticated remote command execution on the affected TP-Link routers.

Reproduction

The vulnerability can be reproduced by first enabling the remote administration interface on the router, which is not the default setting. Once the interface is exposed to the internet, an attacker can authenticate using stolen credentials obtained through an unauthenticated file disclosure vulnerability, and then exploit the command injection vulnerability in the Parental Control page to achieve remote code execution.

Remediation

Users are advised to update to the latest firmware version 241108. Patched firmware for the Archer C7(EU) V2 and TL-WR841N/ND(MS) V9 can be downloaded from the TP-Link support website.