Critical TP-Link Omada Flaws Let Attackers Remotely Run Commands

Key Takeaways

• TP-Link has disclosed multiple critical vulnerabilities affecting several models within its Archer NX series routers.
• The flaws include authorization bypass, command injection, and a hardcoded cryptographic key, enabling remote code execution and full system compromise.
• Affected models are the Archer NX200, NX210, NX500, and NX600, primarily older firmware versions, which are not sold in the U.S. market.
• Immediate firmware updates are crucial to mitigate these high-severity risks.

TP-Link has issued a critical security advisory warning users of severe vulnerabilities present in its Archer NX series routers. These high-severity flaws could allow unauthorized attackers to gain complete control over affected devices, posing significant risks to network security.

The vulnerabilities impact specific models: the Archer NX200, NX210, NX500, and NX600. Exploitation of these weaknesses could enable malicious actors to bypass security protocols, alter crucial configuration files, and ultimately execute arbitrary commands on the underlying operating system of the router.

Unpacking the Vulnerabilities

The advisory highlights four distinct vulnerabilities, each assigned a high severity rating under the CVSS v4.0 framework. These include an authorization bypass, two command injection flaws, and a cryptographic weakness.

The most critical issue identified is an authorization bypass vulnerability. This flaw stems from the HTTP server’s failure to adequately authenticate requests to specific Common Gateway Interface (CGI) endpoints. As a result, unauthenticated attackers can access and perform privileged HTTP actions without needing valid login credentials. This capability could be leveraged to upload malicious firmware or modify device configurations illicitly.

Furthermore, the affected routers are susceptible to severe command injection vulnerabilities within their administrative command-line interfaces (CLIs). By submitting malformed input to the wireless control and modem management CLI paths, authenticated attackers with administrative access can force the system to execute arbitrary operating system commands. Such a compromise threatens the confidentiality, integrity, and availability of the affected devices.

Finally, a cryptographic vulnerability has been identified within the device’s configuration encryption mechanism. Developers inadvertently left a hardcoded cryptographic key embedded within the system architecture. This oversight allows attackers with even basic access privileges to decrypt, modify, and then re-encrypt configuration data without detection, undermining the integrity of device settings.

Affected Products and Mitigation

Compromised network edge devices, such as the Archer NX series routers, often serve as critical entry points for broader network intrusions. Successful exploitation of command injection flaws or authentication bypasses on these devices can establish persistent footholds for threat actors. From these compromised positions, attackers can intercept network traffic, launch targeted attacks, or pivot further into internal network segments, potentially compromising sensitive data and systems.

The vulnerabilities affect various hardware and firmware versions across the Archer NX product line, specifically older builds of the NX200, NX210, NX500, and NX600 routers. It’s important to note that TP-Link does not market or sell these particular models in the United States. To safeguard their network environments, administrators must apply the vendor-provided security patches without delay.

TP-Link has released updated firmware versions specifically designed to address these security deficiencies. Users are strongly advised to visit the official TP-Link support portal, locate and download the latest firmware corresponding to their exact hardware version, and proceed with the update process. Failure to patch these devices leaves networks exposed to potential hijacking and severe operational disruptions.

What You Should Do

• Immediately check if your TP-Link Archer NX200, NX210, NX500, or NX600 router is running an outdated firmware version.
• Visit the official TP-Link support website for your region and download the latest available firmware for your specific router model.
• Apply the firmware update as soon as possible to patch these critical vulnerabilities.
• Ensure your router’s administrative interface is not exposed directly to the internet and use strong, unique passwords for all administrative accounts.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.