CVE-2024-1179: TP-Link Omada ER605 RCE Vulnerability

CVE-2024-1179 Overview

CVE-2024-1179 is a stack-based buffer overflow vulnerability in the TP-Link Omada ER605 router. The flaw resides in the router's Dynamic Host Configuration Protocol version 6 (DHCPv6) client, specifically in the handling of DHCP options. Network-adjacent attackers can exploit the vulnerability without authentication to execute arbitrary code as root. The Zero Day Initiative tracked the issue as ZDI-CAN-22420 before public disclosure.

Critical Impact
An unauthenticated attacker on the adjacent network can achieve remote code execution with root privileges on the ER605, giving full control of the perimeter router.

Affected Products

TP-Link Omada ER605 (hardware version 2.0)
TP-Link Omada ER605 firmware (versions prior to the vendor fix)
TP-Link Omada gateway deployments using ER605 devices

Discovery Timeline

2024-04-01 - CVE-2024-1179 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1179

Vulnerability Analysis

The vulnerability is a classic stack-based buffer overflow [CWE-121] combined with an out-of-bounds write [CWE-787]. It exists in the DHCPv6 client component of the ER605 firmware. When the client processes DHCP options received from a server, it copies attacker-controlled data into a fixed-length stack buffer without validating the input length.

An attacker positioned on the adjacent network can craft a malicious DHCPv6 response containing oversized option values. The overflow overwrites saved registers and return addresses on the stack, redirecting execution to attacker-controlled code. Because the DHCPv6 client runs as root, successful exploitation yields complete device compromise.

The attack requires no authentication and no user interaction. Exploitation impacts confidentiality, integrity, and availability of the router.

Root Cause

The root cause is missing length validation of user-supplied data before a copy operation into a fixed-length stack buffer. The DHCPv6 option parser trusts the option length field supplied by the remote server. It writes past the destination buffer boundary when the field exceeds the buffer size.

Attack Vector

Exploitation requires the attacker to reach the ER605 with DHCPv6 traffic. This is typically an adjacent Layer 2 network segment where the router acts as a DHCPv6 client, such as an upstream WAN link or a peered network. The attacker responds to a DHCPv6 solicitation, or spoofs a DHCPv6 server, and returns options that trigger the overflow. The vulnerability is described in prose only; refer to the Zero Day Initiative Advisory ZDI-24-085 for technical details.

// No verified proof-of-concept code is publicly available.
// The vulnerability is triggered by malformed DHCPv6 option data
// exceeding the size of a fixed-length stack buffer in the
// ER605 DHCPv6 client parser.

Detection Methods for CVE-2024-1179

Indicators of Compromise

DHCPv6 Advertise or Reply packets containing option fields with abnormally large length values sent to the ER605 WAN interface.
Unexpected reboots, crashes, or watchdog events in the ER605 system log around the time DHCPv6 traffic is processed.
New outbound connections from the router to unknown external hosts, indicating post-exploitation activity.
Configuration changes on the ER605 that were not initiated by an administrator.

Detection Strategies

Inspect DHCPv6 traffic destined for router WAN interfaces and alert on options with length fields that exceed protocol norms.
Monitor SNMP and syslog output from the ER605 for repeated DHCPv6 client restarts or memory faults.
Correlate DHCPv6 exchanges with subsequent anomalous outbound traffic from the router itself.

Monitoring Recommendations

Forward ER605 syslog to a centralized log platform and retain DHCP-related events.
Deploy network sensors capable of decoding DHCPv6 and flagging malformed options.
Baseline normal DHCPv6 lease renewal patterns and alert on unexpected server addresses responding to the router.

How to Mitigate CVE-2024-1179

Immediate Actions Required

Apply the latest firmware update for the TP-Link Omada ER605 published by TP-Link.
Restrict which upstream networks can send DHCPv6 traffic to the ER605 WAN interface.
Disable DHCPv6 on the WAN interface if IPv6 is not required for the deployment.
Segment management access to the router and monitor for unauthorized configuration changes.

Patch Information

TP-Link addressed the flaw in an updated Omada ER605 firmware release. Administrators should consult the Zero Day Initiative Advisory ZDI-24-085 and the TP-Link download center for the fixed firmware version corresponding to their hardware revision. Verify the firmware image signature before installation.

Workarounds

Configure the ER605 with a static IPv6 address on the WAN interface instead of using DHCPv6, where operationally feasible.
Place the ER605 behind a trusted upstream device that filters or terminates DHCPv6 traffic from untrusted networks.
Restrict physical and Layer 2 access to any network segment where the ER605 acts as a DHCPv6 client.

bash

# Example: disable IPv6 (and DHCPv6) on the WAN interface via CLI
# Adjust interface name to match your ER605 deployment
configure
interface WAN1
  no ipv6 address dhcp
  no ipv6 enable
commit
exit