TP-LINK Router Administrative Web Interface Backdoor Vulnerability

A vulnerability has been identified in certain TP-LINK routers, which can be exploited by remote attackers to execute arbitrary code on target system.

Certain TP-LINK routers provide access to an administrative web interface which does not require authentication (start_art.html). Remote attacker can trick such routers to download malware from the attacker's TFTP server, and execute the malware in root user privilege. Remote attacker can execute arbitrary code as a root user.

Note:

1. The default setting of the router does not allow WAN access to the administrative web interface.
2. Proof of concept code of the attack is publicly available.
3. Vendor patch is currently unavailable.