CVE-2024-5035

TP-Link Archer C5400X, prior to release Archer C5400X(EU)_V1_1.1.7 Build 20240510, is vulnerable to remote code execution through the rftest binary exposed on TCP port 8888, 8889 and 8890.

Proof-of-Concept

The network service restricts commands to those beginning with "wl" or "nvram get," but researchers at ONEKEY discovered this limitation "could be trivially bypassed by injecting a command after shell meta-characters like ; , & , or, | (e.g., "wl;id;")."

The documentation author notes difficulty reproducing this exploit on comparable TP-Link devices, and indicates that FirmAE does not support emulation of the Archer C5400X model.