Vulnerability Deep Dive: TP-Link TL-R600VPN remote code execution vulnerabilities
Summary: TP-Link patched three vulnerabilities in its TL-R600VPN gigabit broadband VPN router in firmware version 1.3.0, and Cisco Talos disclosed them after coordinating with the vendor. One flaw in how the HTTP server handles requests to the /fs/ directory lets an authenticated attacker remotely execute code on the device, which runs a Realtek RTL8198 chip using a Lexra MIPS-1 offshoot.
Why it matters: The exploit path is concrete: a request to a page like /fs/help with no file extension sends the parser seeking backward into attacker-supplied header data, overwriting the saved return address and handing over execution in the HTTPD process. Talos notes these vulnerabilities are all too common in IoT devices, and that an internet-facing SOHO router is a computer whose software must be maintained.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026