CVE-2024-1179 Overview
CVE-2024-1179 is a stack-based buffer overflow in the TP-Link Omada ER605 router that allows network-adjacent attackers to execute arbitrary code as root. The flaw resides in the DHCPv6 client's handling of DHCP options, where user-supplied data is copied into a fixed-length stack buffer without proper length validation. Authentication is not required, and exploitation occurs over the adjacent network. The issue was reported through the Zero Day Initiative as ZDI-CAN-22420. TP-Link Omada ER605 routers are widely deployed as small-business VPN gateways, making this vulnerability relevant to branch and edge networks.
Critical Impact
Unauthenticated network-adjacent attackers can execute arbitrary code with root privileges on affected ER605 routers, resulting in full device compromise.
Affected Products
- TP-Link Omada ER605 (hardware version 2.0)
- TP-Link Omada ER605 Firmware (versions prior to the vendor fix)
- Omada SDN gateway deployments using the ER605 as an edge router
Discovery Timeline
- 2024-04-01 - CVE-2024-1179 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-1179
Vulnerability Analysis
The vulnerability exists inside the DHCPv6 client component of the ER605 firmware. When the router requests network configuration over IPv6, the client parses DHCP options returned by a DHCPv6 server or a rogue peer on the local segment. One of these option-parsing paths copies attacker-controlled data into a fixed-size buffer allocated on the stack.
Because the code does not validate the length of the incoming option field before the copy, an oversized value overwrites adjacent stack memory. This includes saved return addresses and stack frame metadata, giving an attacker control over program flow. The vulnerability is classified under [CWE-121] Stack-based Buffer Overflow and [CWE-787] Out-of-bounds Write. Successful exploitation yields arbitrary code execution in the context of root, the account under which the DHCPv6 client operates on embedded Linux-based TP-Link firmware.
Root Cause
The root cause is missing input validation on the length of user-supplied DHCPv6 option data prior to a stack copy operation. The client trusts the length or content encoded in the option payload and does not enforce a bound check against the destination buffer size. This is a classic unchecked-copy pattern common in embedded network daemons written in C.
Attack Vector
Exploitation requires network adjacency, meaning the attacker must be on the same broadcast domain or an adjacent IPv6 segment reachable by the router's DHCPv6 client. An attacker positions a malicious DHCPv6 server, or replies faster than the legitimate server, and returns crafted options that overflow the client-side buffer. No user interaction or credentials are needed. Once code execution is achieved, the attacker gains root-level control of the gateway, enabling traffic interception, lateral movement, and persistence.
See the Zero Day Initiative Advisory ZDI-24-085 for the vendor-coordinated technical summary.
Detection Methods for CVE-2024-1179
Indicators of Compromise
- Unexpected or unauthorized DHCPv6 server advertisements on internal network segments.
- ER605 devices exhibiting reboots, crashes, or unusual outbound connections following DHCPv6 exchanges.
- New administrative accounts, altered firewall rules, or modified DNS settings on the router.
- Outbound traffic from the router to unfamiliar hosts, indicative of a post-exploitation implant.
Detection Strategies
- Monitor Layer 2 segments for rogue DHCPv6 servers using IPv6 RA Guard and DHCPv6 snooping features on managed switches.
- Inspect DHCPv6 option payloads for oversized fields that exceed protocol norms.
- Baseline expected DHCPv6 traffic patterns and alert on unusual client-server pairings involving the ER605.
Monitoring Recommendations
- Forward router syslog and management-plane events to a centralized log platform for correlation.
- Track firmware version and configuration drift across the Omada fleet to identify unpatched devices.
- Alert on new outbound sessions originating from gateway devices, which typically do not initiate arbitrary client traffic.
How to Mitigate CVE-2024-1179
Immediate Actions Required
- Apply the latest TP-Link Omada ER605 firmware update that addresses the DHCPv6 client parsing flaw.
- Restrict which network segments can reach the router's DHCPv6 client, particularly on WAN-facing interfaces.
- Audit the local network for unauthorized DHCPv6 servers and enforce DHCPv6 snooping where supported.
Patch Information
TP-Link addressed this issue in a firmware update coordinated through the Zero Day Initiative. Administrators should consult the Zero Day Initiative Advisory ZDI-24-085 and the TP-Link support portal for the ER605 to download the fixed firmware image. Verify device hardware revision before flashing.
Workarounds
- Disable IPv6 or the DHCPv6 client on interfaces where IPv6 addressing is not required.
- Segment the router's WAN and LAN broadcast domains to limit exposure to attacker-controlled DHCPv6 traffic.
- Deploy IPv6 first-hop security controls such as RA Guard and DHCPv6 Guard on upstream switches.
- Restrict physical and wireless access to the local network segment serving the ER605 until the firmware update is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
