CVE-2020-10883

HIGH

TP-Link Archer A7 Firmware <190726 - Privilege Escalation

Title source: llm

Description

This vulnerability allows local attackers to escalate privileges on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the file system. The issue lies in the lack of proper permissions set on the file system. An attacker can leverage this vulnerability to escalate privileges. Was ZDI-CAN-9651.

Exploits (2)

exploitdb WORKING POC

rubyremotelinux_mips

https://www.exploit-db.com/exploits/48331

View on exploitdb

metasploit WORKING POC EXCELLENT

rubypoclinux

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/tplink_archer_a7_c7_lan_rce.rb

View Code ZIP pw:eip

References (2)

[Exploit, Third Party Advisory, VDB Entry] http://packetstormsecurity.com/files/157255/TP-Link-Archer-A7-C7-Unauthenticated-LAN-Remote-Code-Execution.html

[Third Party Advisory, VDB Entry] https://www.zerodayinitiative.com/advisories/ZDI-20-335/

Scores

CVSS v3 7.8

EPSS 0.0160

EPSS Percentile 81.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-732

Status published

Affected Products (1)

tp-link/ac1750_firmware

Timeline

Published Mar 25, 2020

Tracked Since Feb 18, 2026