# Exploit Title: Buffer Overflow in TP-Link Archer AX10(EU)_V1.2_230220 # Exploit Author: Giuseppe Compare # Date : 26/05/2023 # CVE: CVE-2023-34832 # Vendor Homepage: https://www.tp-link.com/ # Version: TP-Link Archer AX10(EU)_V1.2_230220 Buffer Overflow There is a buffer overflow in the FUN_131e8 function due to using sprintf improperly, detailed in line 47-49 memset(&DAT_000283a4,0,0x800); sprintf(&DAT_000283a4,"echo \'[ %s ] %d: get OCN v6plus rules begin\n \' > /dev/console", "https_get_rules_OCN",0x3c3); system(&DAT_000283a4); //line 47-49 sprintf((char *)&local_428, "https://rule.map.ocn.ad.jp/?ipv6Prefix=%s&ipv6PrefixLength=%d&code=e8mMWklYwaGoHmT05ynqVM4kPqF9rAUnhrWCp1vWvBeSOO0pfpMokg==" ,param_2 + 0x23,param_2[0x2d]); The sprintf() function makes no guarantees regarding the length of the generated string, a sufficiently long string passed as an additional argument could generate a buffer overflow. Remediation Guarantee that storage for strings has sufficient space for character data and the null terminator. Avoid using unsafe functions such as sprintf(), consider using snprintf() or sprintf_s() and variants. Double check that your buffer is as large as you specify. Check buffer boundaries if accessing the buffer in a loop and make sure there is no danger of writing past the allocated space.