CVE-2024-5243: TP-Link Omada ER605 RCE Vulnerability

CVE-2024-5243 Overview

CVE-2024-5243 is a buffer overflow vulnerability in TP-Link Omada ER605 routers that allows network-adjacent attackers to execute arbitrary code without authentication. The flaw resides in the DNS name handling logic used by the Comexe Dynamic DNS (DDNS) service integration. Devices are only vulnerable when configured to use Comexe DDNS. Successful exploitation grants code execution in the context of root, giving attackers full control over the router. The vulnerability was reported through the Zero Day Initiative as ZDI-CAN-22523 and is tracked as [CWE-120] classic buffer overflow.

Critical Impact
Network-adjacent attackers can achieve unauthenticated root-level remote code execution on TP-Link Omada ER605 routers configured with Comexe DDNS.

Affected Products

TP-Link Omada ER605 hardware version 2.6
TP-Link Omada ER605 firmware version 2.2.2 Build 20231017
TP-Link Omada ER605 deployments configured to use the Comexe DDNS service

Discovery Timeline

2024-05-23 - CVE-2024-5243 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5243

Vulnerability Analysis

The vulnerability exists in the code path that processes DNS names returned by the Comexe DDNS service. The router copies attacker-controllable DNS response data into a fixed-size buffer without validating the length of the input. This classic buffer overflow ([CWE-120]) corrupts adjacent memory on the stack or heap and enables arbitrary code execution. Because the affected process runs as root, exploitation yields full administrative control of the device. Attackers can pivot deeper into the network, intercept traffic, install persistent implants, or use the router as a foothold for lateral movement. TP-Link Omada ER605 devices are commonly deployed as small-business and branch-office VPN routers, which increases the operational impact of a compromise.

Root Cause

The root cause is missing bounds validation on user-supplied data prior to a buffer copy operation. When the ER605 parses DNS name fields associated with the Comexe DDNS workflow, it trusts the length of the received data. An overlong DNS name overflows the destination buffer and overwrites adjacent memory used for control flow.

Attack Vector

Exploitation requires an adjacent-network position, meaning the attacker must be able to reach the router across a logically adjacent network segment or coerce responses from a network path used by the DDNS client. No authentication and no user interaction are required. The attacker delivers a malicious DNS response containing an oversized name field, which the vulnerable parser copies into an undersized buffer. The router must be configured to use the Comexe DDNS service for the vulnerable code path to execute.

A verified proof-of-concept is not publicly available. See the Zero Day Initiative Advisory ZDI-24-502 for the disclosure record.

Detection Methods for CVE-2024-5243

Indicators of Compromise

Unexpected outbound connections initiated by the ER605 router to unfamiliar hosts, particularly following DDNS resolution activity
DNS responses to the router containing abnormally long name fields or malformed record structures
Router configuration changes, new administrative sessions, or unexplained reboots in device logs
Traffic redirection, DNS hijacking, or ARP anomalies observed on network segments served by the router

Detection Strategies

Inspect DNS traffic to and from the router for oversized name fields or protocol anomalies inconsistent with RFC 1035 length limits
Audit ER605 configurations to identify devices with the Comexe DDNS service enabled, since these are the only exploitable configurations
Correlate DDNS update events with subsequent anomalous router behavior such as unexpected process crashes or configuration drift

Monitoring Recommendations

Enable syslog forwarding from Omada ER605 devices to a centralized log platform and monitor for reboots, crashes, and authentication anomalies
Baseline expected DDNS provider destinations and alert on deviations from that baseline
Restrict and monitor management-plane and DDNS-related traffic paths to reduce exposure to adjacent-network attackers

How to Mitigate CVE-2024-5243

Immediate Actions Required

Disable the Comexe DDNS service on Omada ER605 devices where it is not required, since the vulnerable code path is only reachable when this service is configured
Update affected TP-Link Omada ER605 firmware to the latest available version published by TP-Link
Restrict management-plane and DDNS network exposure so that only trusted network segments can reach the router
Inventory Omada ER605 deployments and prioritize remediation for units running firmware 2.2.2 Build 20231017 or earlier

Patch Information

TP-Link addresses this issue in firmware released after the ZDI disclosure. Refer to the Zero Day Initiative Advisory ZDI-24-502 and the TP-Link support portal for the ER605 to obtain the corrected firmware image. Apply the vendor-supplied firmware update to remove the vulnerable DNS-name handling logic.

Workarounds

Switch the router to an alternative DDNS provider that does not invoke the vulnerable Comexe DDNS code path
Segment the ER605 from untrusted adjacent networks using VLANs and firewall rules to reduce reachability by potential attackers
Where DDNS is not required, disable the feature entirely to eliminate the attack surface

bash

# Configuration example: disable DDNS via the Omada controller UI
# Navigate to: Settings > Network > Dynamic DNS
# Set: Status = Disabled for the Comexe DDNS entry
# Save and apply configuration, then verify firmware version:
#   System Tools > Firmware Upgrade
# Confirm the running firmware is later than 2.2.2 Build 20231017