> For the complete documentation index, see [llms.txt](https://0xpthree.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xpthree.gitbook.io/notes/exploits-pocs/tp-link-cve-2024-5035.md).

# TP-Link - CVE-2024-5035

**TP-Link Archer C5400**<mark style="color:red;">**X**</mark>, prior to release `Archer C5400X(EU)_V1_1.1.7 Build 20240510`, is vulnerable to <mark style="color:red;">**remote code execution**</mark> through the `rftest` binary exposed on TCP port 8888, 8889 and 8890.

<figure><img src="/files/P0D6KoZ1oIhINgsmwhk7" alt=""><figcaption></figcaption></figure>

## Proof-of-Concept

While the network service is designed to only accept commands that start with "[wl](https://wiki.dd-wrt.com/wiki/index.php/Wl_command)" or "[nvram get](https://wiki.dd-wrt.com/wiki/index.php/Hardware#NVRAM)," ONEKEY found that the restriction could be trivially bypassed by injecting a command after shell meta-characters like ; , & , or, | (e.g., "wl;id;").

<figure><img src="/files/OmpmNsHeESlaiKrQcQSR" alt=""><figcaption></figcaption></figure>

I have tried to emulate similar TP-Link devices, such as **Archer C5400**, but have not been able to reproduce the exploit. [FirmAE](/notes/development/docker/firmae-emulate-firmware.md) does not support emulation of Archer C5400X.