TP-Link Archer A7 DNS Response Stack-Based Buffer Overflow Enables Root Code Execution

This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of DNS responses. A crafted DNS message can trigger an overflow of a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the root user. Was ZDI-CAN-9660.

• Affected product: TP-Link Archer A7 AC1750 routers running Firmware Ver: 190726 are marked affected in the normalized record.
• Fixed release identified by the CNA: ZDI lists A7(US)_V5_200220 as fixed.
• This fixed release does not by itself establish the status of every regional, hardware, or parallel release branch. Verify the applicable branch for each device before concluding that it is remediated.

TP-Link Archer A7 processes a crafted DNS response in its DNS-handling component. The input can overflow a fixed-length stack-based buffer, which is classified as CWE-121. Successful exploitation can lead to arbitrary code execution in the context of the root user. The available evidence does not identify the exact function, process, or network endpoint involved, and it does not establish whether the vulnerable DNS service is directly reachable from the Internet or only from a particular network segment. The supported affected scope is limited to the Archer A7 firmware and branch identified in affected_summary.

The flaw can be exploited remotely over the network by sending a crafted DNS message. Authentication is not required, user interaction is not required, and the supplied record describes the attack complexity as low. Successful exploitation can give the attacker code execution with root privileges on the router. The record and inspected advisory do not establish whether the flaw has been exploited in the wild or whether a public exploit is available. The available evidence does not specify the network interface or routing conditions required to deliver the DNS message to the vulnerable component.

Successful exploitation can result in arbitrary code execution with root privileges on the router. This could allow changes to device configuration or network-processing behavior, service disruption, and interference with traffic passing through the device. The privileged execution context creates potential confidentiality, integrity, and availability consequences for data and services that depend on the router. The record does not establish lateral movement, impact beyond the vulnerable device, or an actual data disclosure.

• A compromised device may be fully controlled at the root level, creating risk to network routing and device configuration.
• An attacker could potentially alter router behavior, disrupt connectivity, or interfere with DNS processing. These are possible consequences of privileged code execution, not incidents confirmed by the record.
• Because a router handles traffic for dependent systems, compromise could affect the confidentiality, integrity, and availability of services that rely on it.
• The record provides no evidence of a named victim, campaign, data breach, or impact spreading to other systems.

1. Upgrade affected TP-Link Archer A7 devices on the applicable branch to A7(US)_V5_200220, which ZDI identifies as fixed.
2. After upgrading, verify the firmware or build identifier on every device and reconcile it with the correct hardware or regional branch. Do not assume that every later release or different branch is fixed based only on this release.
3. If the applicable branch cannot be confirmed, treat the device as unverified, reduce untrusted network reachability while remediation is pending, and consult TP-Link's official support material. The available evidence does not establish a specific workaround.

• Inventory all deployed TP-Link Archer A7 AC1750 routers, including devices at branch offices, small offices, and centrally managed residential locations.
• Read the firmware or build identifier from available asset inventory or the device management interface, then compare it with Firmware Ver: 190726 and the fixed release A7(US)_V5_200220 listed in affected_summary.
• If DNS telemetry is available, review anomalous or malformed DNS responses as a precaution. The advisory does not provide a specific IOC, log event, or detection signature.
• Do not treat the absence of suspicious logs or DNS failures as proof that a device is safe. Verify the exact firmware and hardware or regional branch for each device.