CVE-2024-57040 TP-Link TL-WR845N routers critical vulnerability CVSS - 9.8 SEVERITY-CRITICAL

The flaw, identified as CVE-2024-57040 and assigned a CVSS score of 9.8 (Critical), exposes hardcoded root shell credentials stored within the router’s firmware files, creating a significant security risk for users worldwide.

 the vulnerability stems from MD5-hashed root passwords stored in plaintext within publicly accessible firmware files.

The credentials are stored in two specific locations: “squashfs-root/etc/passwd” and “squashfs-root/etc/passwd.bak”. The exposed hardcoded root password can be easily cracked to reveal “1234” while the root username appears in plaintext as “admin.”

Security experts note that all known firmware versions of the TP-Link TL-WR845N router are affected, including:

    TL-WR845N(UN)_V4_190219
    TL-WR845N(UN)_V4_200909
    TL-WR845N(UN)_V4_201214


This vulnerability presents a severe security risk as attackers with these credentials can essentially take full control of the router, potentially intercepting network traffic and installing persistent backdoors.


Mitigation Steps >>>


    Modify the admin password to a strong, unique alternative.
    Secure the router’s location to prevent physical tampering and SPI flash extractions.
    Block any unnecessary remote access interfaces like SSH/Telnet.
    Regularly check for unauthorized access attempts or suspicious behavior.
While the current firmware versions remain vulnerable, TP-Link may release security patches in future updates that can be installed through the router’s management interface at http://tplinkwifi.net