CVE-2017-13772

This vulnerability is like a “too-small clipboard” bug in the router’s code: when the router receives certain specially-crafted inputs, it can overwrite important memory and then run attacker-controlled code. In plain terms, a logged-in attacker could potentially take over the router and change how your business internet connection behaves.

This matters if you run or manage a TP-Link WR940N WiFi router firmware on hardware version 4. The risk is specifically for remote attackers who can log in to the router (it’s not purely open to the internet). Only treat it as actively dangerous if the router is reachable from outside your local network and an attacker can authenticate to the admin interface.

This is an AMBER issue because there is a working public exploit available, meaning attackers can realistically attempt the takeover. Even though it requires authentication, the combination of public exploit code and router-facing exposure makes this a practical risk for businesses that allow remote admin access.

1. Confirm exposure (fast checklist):

   • Identify your router model: TP-Link WR940N WiFi router.
   • Identify hardware version: confirm it is hardware version 4 (usually shown on a label).
   • Identify firmware version: record the exact firmware build/number from the router’s admin page.

2. Check reachability and authentication paths:

   • Determine whether “remote management” (admin access from the internet) is enabled.
   • Check for any port forwarding or firewall rules that expose router admin pages to the internet.
   • Review whether any VPN/user accounts or web management features allow logins from outside your local network.

3. Look for a fixed firmware (no patch details available here):

   • This report does not include a confirmed fixed version or patch package. Contact TP-Link support or your router vendor and ask for a remediation specific to your exact firmware version and hardware version 4.
   • If they provide a fixed firmware version, upgrade to that exact version.

4. Mitigation if no fixed firmware is available or you can’t verify one:

   • Disable remote management and restrict router administration to the local network only.
   • Remove port forwards that would allow external logins to the router.
   • Use strong, unique admin credentials (and avoid reusing passwords across systems).
   • Consider segmenting: keep the management/admin interface reachable only from your internal admin workstation(s).

5. Recovery planning:

   • If you suspect compromise (unexpected settings changes, new accounts, unusual DNS settings, or unexplained connectivity issues), isolate the router from the internet immediately (disconnect WAN), then investigate from a clean internal path and consider factory reset + restore only trusted settings.

6. What to monitor:

   • Unusual configuration changes after off-hours.
   • New admin users or changed admin credentials.
   • DNS and WAN configuration changes that don’t match your actions.
   • Router logs for repeated login attempts or parameter-related errors (if logs are available).

CVE-2017-13772 (CWE-119) is a stack-based buffer overflow in TP-Link WR940N WiFi routers with hardware version 4. The mechanism is that remote authenticated users can supply crafted values to web endpoints: ping_addr via PingIframeRpm.htm and/or dnsserver2 via WanStaticIpV6CfgRpm.htm, leading to memory corruption and potential arbitrary code execution.

Exploitation status: public exploit available (2 known). KEV is not listed, so there is no CISA KEV confirmation in the provided findings. EPSS is a prediction and is not used as a decision driver here. The traffic-light verdict is AMBER, consistent with real exploit availability and practical reachability concerns, but with a requirement for authentication.

Attack vector: network-based web request to the router management interface. Preconditions: attacker must be able to authenticate to the router (remote authenticated user). Impact scope can include full router compromise, which then enables traffic manipulation and denial of service across the connected local network.

What KEV means here: CISA’s Known Exploited Vulnerabilities list is not populated for this CVE in the provided findings, so it is not confirmed by KEV in this dataset.