TP-Link CVE-2023-33538 Exploitation Attempts Fail, but Firmware Analysis Confirms Vulnerability
Summary
Unit 42 found observed Mirai-like botnet attempts against end-of-life TP-Link routers were flawed, but firmware analysis confirmed authenticated command injection via ssid1 in CVE-2023-33538; default credentials may enable exploitation.
Key points
- Telemetry showed automated attempts against several end-of-life TP-Link router models, but the observed requests used the wrong parameter, lacked authentication, or relied on unavailable utilities.
- Firmware emulation and reverse engineering confirmed command injection through the ssid1 parameter at /userRpm/WlanNetworkRpm.htm.
- Exploitation requires authenticated access to the router's web interface; the researchers identified default credentials in the analyzed firmware.
- In emulation, researchers confirmed injected commands could modify a boot script, demonstrating potential persistence; a reboot command could also cause denial of service.
- The analyzed arm7 binary was Mirai-like and included command-and-control, binary-update, and HTTP-serving capabilities for distributing payloads across architectures.
- The affected devices are end-of-life, and TP-Link said no patches are available; its recommendation is to replace them and avoid default credentials.
Article Details
- Attack Vectors
- CVE-2023-33538 allows command injection through the unsanitized ssid1 parameter in authenticated GET requests to /userRpm/WlanNetworkRpm.htm. The researchers confirmed command execution in emulated TL-WR940N v4 firmware.
- The observed scans attempted to use admin:admin credentials, download an ELF payload such as arm7, change its permissions, and execute it. The article reports that most observed attempts failed because they used ssid instead of ssid1 and relied on wget, which was absent from the tested firmware.
- The Mirai-like arm7 binary communicates with hard-coded C2 infrastructure, downloads multi-architecture updates, and serves malware binaries over HTTP to other devices.
- Defensive Notes
- TP-Link stated that the affected devices are end-of-life and have no vendor patches available; it recommends replacing them with supported hardware and not using default credentials.
- Palo Alto Networks said Advanced URL Filtering and Advanced DNS Security identify known malicious URLs and domains associated with the campaign, and that Advanced WildFire analysis was updated with the shared indicators.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bot[.]ddosvps[.]cc | Attacker-used domain hosting top1hbt malware binaries and associated with C2 infrastructure. |
| DOMAIN | cnc[.]vietdediserver[.]shop | Domain identified as malicious and associated with Mirai-like botnet C2 infrastructure. |
| IPV4 | 51[.]38[.]137[.]113 | Attacker-used host that served malware binaries and was hard-coded as C2 infrastructure in the Mirai-like samples. |
| SHA256 | 3fbd2a2e82ceb5e91eadbad02cb45ac618324da9b1895d81ebe7de765dca30e7 | SHA-256 hash of the malicious arm payload. |
| SHA256 | 4caaa18982cd4056fead54b98d57f9a2a1ddd654cf19a7ba2366dfadbd6033da | SHA-256 hash of the malicious arm5 payload. |
| SHA256 | 534b654531a6a540a144da9545ee343e1046f843d7de4c1091b46c3ee66a508b | SHA-256 hash of the malicious mips payload. |
| SHA256 | 56f21f412e898ad9e3ee05d5f44c44d9d7bcb9ecbfbdb9de11b8fa5a637aeef6 | SHA-256 hash of the malicious x86_64 payload. |
| SHA256 | 7bbb21fec19512d932b7a92652ed0c8f0fedea89f34b9d6f267cf39de0eb9b20 | SHA-256 hash of the malicious arm7 payload, described as a Mirai variant. |
| SHA256 | 919f292a07a37f163f88527e725406187c8ecc637387ad24853fe49ce4e6ddf4 | SHA-256 hash of the malicious sh4 payload. |
| SHA256 | 9df711c3aef2bba17b622ddfd955452f8d8eb55899528fbc13d9540c52f13402 | SHA-256 hash of the malicious arm6 payload. |
| URL | hxxp[:]//51[.]38[.]137[.]113/arm | Malware payload-download URL for the arm binary. |
| URL | hxxp[:]//51[.]38[.]137[.]113/arm5 | Malware payload-download URL for the arm5 binary. |
| URL | hxxp[:]//51[.]38[.]137[.]113/arm6 | Malware payload-download URL for the arm6 binary. |
| URL | hxxp[:]//51[.]38[.]137[.]113/arm7 | Malware payload-download URL for the arm7 binary. |
| URL | hxxp[:]//51[.]38[.]137[.]113/mips | Malware payload-download URL for the mips binary. |
| URL | hxxp[:]//51[.]38[.]137[.]113/sh4 | Malware payload-download URL for the sh4 binary. |
| URL | hxxp[:]//51[.]38[.]137[.]113/x86_64 | Malware payload-download URL for the x86_64 binary. |
| URL | hxxp[:]//bot[.]ddosvps[.]cc/top1hbt[.]arm | Malware payload-download URL for the top1hbt.arm binary. |
| URL | hxxp[:]//bot[.]ddosvps[.]cc/top1hbt[.]arm5 | Malware payload-download URL for the top1hbt.arm5 binary. |
| URL | hxxp[:]//bot[.]ddosvps[.]cc/top1hbt[.]arm6 | Malware payload-download URL for the top1hbt.arm6 binary. |
| URL | hxxp[:]//bot[.]ddosvps[.]cc/top1hbt[.]arm7 | Malware payload-download URL for the top1hbt.arm7 binary. |
| URL | hxxp[:]//bot[.]ddosvps[.]cc/top1hbt[.]mips | Malware payload-download URL for the top1hbt.mips binary. |
| URL | hxxp[:]//bot[.]ddosvps[.]cc/top1hbt[.]mpsl | Malware payload-download URL listed in the article's threat-infrastructure indicators. |
| URL | hxxp[:]//bot[.]ddosvps[.]cc/top1hbt[.]sh4 | Malware payload-download URL for the top1hbt.sh4 binary. |
| URL | hxxp[:]//bot[.]ddosvps[.]cc/top1hbt[.]x86_64 | Malware payload-download URL for the top1hbt.x86_64 binary. |
MITRE ATT&CK
T1037.004 · RC ScriptsThe researchers demonstrated writing to /etc/rc.d/rcS, which the article identifies as a boot-executed script that an attacker could overwrite to run a payload at startup.T1059 · Command and Scripting InterpreterInjected content is passed to execve("/bin/sh") to execute shell commands on the router.T1071 · Application Layer ProtocolThe arm7 binary receives command sequences over a network socket and uses HTTP GET requests for C2-related binary updates.T1078 · Valid AccountsThe article reports that authenticated access is required and describes use of default admin:admin credentials to obtain a session token.T1105 · Ingress Tool TransferExploit attempts and the malware's updater use HTTP GET requests to retrieve ELF payloads from attacker-used servers.T1190 · Exploit Public-Facing ApplicationThe exploit targets the router's web management endpoint and injects commands through the vulnerable ssid1 parameter.T1543 · Create or Modify System ProcessThe arm7 binary starts an HTTP daemon, forks child processes, and serves updated malware binaries from infected devices.
CVE
Malware
Vendors
Products
TL-WR740N v1Active, large-scale scans exploited CVE-2023-33538 against end-of-life TPâLink models (TL-WR940N v2/v4, TL-WR740N v1/v2, TL-WR841N v8/v10) to deliver Mirai-like binaries.TL-WR841N v8Active, large-scale scans exploited CVE-2023-33538 against end-of-life TPâLink models (TL-WR940N v2/v4, TL-WR740N v1/v2, TL-WR841N v8/v10) to deliver Mirai-like binaries.TL-WR940N v2Active, large-scale scans exploited CVE-2023-33538 against end-of-life TPâLink models (TL-WR940N v2/v4, TL-WR740N v1/v2, TL-WR841N v8/v10) to deliver Mirai-like binaries.TL-WR940N v4[Firmware ] Vulnerable firmware image used for analysis – wr940n_us_3_16_9_up_boot(160617).bin (TP-Link TL-WR940N v4 firmware extracted and emulated; SHA256 referenced in report).
Tools
Binary NinjaFigure 4. Full update routine in the arm7 binary, as shown in Binary Ninja’s decompiler.Burp SuiteAfter generating the cookie, the web admin panel makes a request to the login endpoint, which responds with the URL with session cookie. Figure 24 shows the response with the session cookie from Burp Suite.firmware-analysis-toolkitWe then used the publicly available firmware-analysis-toolkit to extract and emulate the firmware, establishing the necessary environment for testing.radare2Figure 3. Connection and command buffer of the arm7 binary shown in Radare2.