TP-Link failed to patch a vulnerability in its routers for more than a year.
The bug is in a protocol that allows ISPs to manage routers deployed at customer premises, also known as CWMP or TR-069.
TP-Link was notified of the bug in May last year.
ZERO-DAY ALERT: Automated Discovery of Critical CWMP Stack Overflow in TP-Link Routers
This article documents a zero-day vulnerability discovered through automated analysis and reported to TP-Link on May 11th, 2024. The vulnerability remains unpatched at the time of publication, making…
Medium (medium.com)
