MrBruh's Epic Blog

TP-Link 2 - Electric Boogaloo

This writeup is a counterpart to my “Finding a RCE in my old TP-Link router” vulnerability, and was originally planned to be released alongside it, however TP-Link lost my report and didn’t triage it until I followed up months later.

You should read my other TP-Link writeup before continuing to read this, as it provides useful context.

Reverse Engineering

While reverse engineering the httpd (HTTP Server) binary, I saw the following function:

Tplink Ida Pseudocode

It gets called when you try to update ISP related information (dial-up?) via the administrator web ui.

ISP Upgrade UI Screenshot

I had recently done a CTF challenge where you had to use a zip-slip attack to access the flag and thought it would be interesting to see if the router’s version of BusyBox was vulnerable to it.

First I checked the BusyBox version by running ‘strings’ on it.

❯ strings busybox | grep BusyBox
BusyBox v1.23.2

After doing some research, I found that this extremely old version of BusyBox was vulnerable to zipslip.

Busybox 1.23.2 patch notes

The patch for which, was implemented in the following major version.

Busybox 1.24.0 patch notes

Exploitability

The main problem I found when trying to achieve RCE using this, was that the entire squashfs root filesystem is mounted as read only, so you cannot take the easy way out by overwriting a system binary.

What I did find, was that you could write to the modem partition on /tmp/udisk and achieve code execution on that.

The malicious zip shown in the video above was generated using the following Python code:

with zipfile.ZipFile("NetIspInfo.zip", "w") as zf:
    zf.writestr("NetIspInfo.ini", ini_content)
    zf.writestr("../../tmp/udisk/PWNED", "ZIP_SLIP_CONTENT")

It should be noted that I did not try to overwrite any of the binaries on /tmp/udisk since it could brick my router (and since they aren’t paying me a bug bounty, I don’t consider it to be a worthwhile risk to be taking).

Bug Bounty

When following up on the status on this report I asked about their bug bounty programme and if I was eligible to be paid for either of my findings.

CVE-2026-3841 - HIGH 8.5

CVE-2026-12339 - MEDIUM 6.9

You can see in the following links they claim to run a bug bounty programme.

https://www.tp-link.com/us/landing/security-commitment

Screenshot of TP-Link saying they run a bug bounty

https://www.tp-link.com/us/press/security-advisory/

Additional screenshot of TP-Link saying they run a bug bounty

When they responded, they clarified that it was private and invite only:

Thank you for taking the time and making the effort to submit your reports. We truly appreciate your interest in helping improve the security of our products.

At this time, our bug bounty program is private and limited to specific products on an invitation-only basis. We do plan to expand the program in the future, and we will be sure to let you know if and when additional opportunities become available.

Disclosure Timeline (DD/MM/YYYY)