CVE-2021-35003: tp-link archer_c90_firmware Stack-based Buffer Overflow
Vulnerability summary
CVE-2021-35003 is a high (CVSS 10.0) Stack-based Buffer Overflow vulnerability in tp-link archer_c90_firmware. EPSS estimates a 7.74% chance of exploitation in the next 30 days, higher than 94.6% of scored vulnerabilities.
Timeline
- 21-01-2022PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer C90 1.0.6 Build 20200114 rel.73164(5553) routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of DNS responses. A crafted DNS message can trigger an overflow of a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-14655.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
7.74%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
No change 0.00 pp
From 7.74% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Tp-link1 product
- archer_c90_firmware1.0.6 Build 20200114 rel.73164(5553) | 1.0.6:build_20200114
1 vendor · 1 product