CVE-2024-54887PoC(tp-link / tl-wr940n)

LOWCVSS 8.0 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Prioritize remediation for tp-link tl-wr940n systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

TP-Link TL-WR940N V3 and V4 with firmware 3.16.9 and earlier contain a buffer overflow via the dnsserver1 and dnsserver2 parameters at /userRpm/Wan6to4TunnelCfgRpm.htm. This vulnerability allows an authenticated attacker to execute arbitrary code on the remote device in the context of the root user.

tp-link CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/JBince/vulnerability-research/tree/main/CVE-2024-54887

Weakness type (CWE)

CWE-120

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

tl-wr940n
tl-wr940n_firmware

Threat summary

Public PoC and exploit tooling are both present
1 mentions across 1 observed day

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Affected systems

Vendors

tp-link

Products

tl-wr940ntl-wr940n_firmware

2 versions affected across 2 products

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

PoC

1100.0%

Referenced assets1 URL

By indicator

https://github.com/Gumbraise/CVE-2024-54887-PoC

Full discourse1 post

Gumbraise.𝚟𝚞𝚎@gumbraise137d
PoC
GitHub - Gumbraise/CVE-2024-54887-PoC: A simple, educational proof-of-concept script for TP-Link TL-WR940N authenticated RCE. -https://github.com/Gumbraise/CVE-2024-54887-PoC
Post summary
The text announces a GitHub repository containing a simple, educational proof‑of‑concept script that demonstrates an authenticated remote code execution vulnerability on the TP‑Link TL‑WR940N router. No patch, active exploitation, or debunking information is provided.
0001046
214 followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	tp-link	tl-wr940n	v3	-	-
HW	tp-link	tl-wr940n	v4	-	-
OS	tp-link	tl-wr940n_firmware	-	-	-

Explore more

Back to dashboard tp-link CVEs tl-wr940n vulnerabilities