CVE-2025-56565 Overview
CVE-2025-56565 affects DD-WRT firmware deployed on TP-Link TL-WR740N v1 through v4 hardware. The firmware stores sensitive authentication credentials in cleartext within non-volatile memory (NVRAM). Exposed material includes SSH private keys, dynamic DNS passwords, email notification credentials, and administrative passwords. An attacker with physical access can extract these credentials from an SPI flash dump. The compromise extends beyond the device to the connected network and any third-party services that reuse the exposed credentials.
Critical Impact
Physical access to a vulnerable TL-WR740N allows an attacker to recover SSH keys, admin passwords, and third-party service credentials directly from SPI flash, enabling network infiltration and lateral compromise of dependent services.
Affected Products
- DD-WRT firmware deployed on TP-Link TL-WR740N v1
- DD-WRT firmware deployed on TP-Link TL-WR740N v2 and v3
- DD-WRT firmware deployed on TP-Link TL-WR740N v4
Discovery Timeline
- 2026-09-16 - CVE-2025-56565 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2025-56565
Vulnerability Analysis
The vulnerability is a cleartext storage of sensitive information issue in DD-WRT firmware running on the TP-Link TL-WR740N router family. DD-WRT uses NVRAM on the device's SPI flash chip to persist configuration state across reboots. On the affected hardware, values that should be treated as secrets are written to NVRAM without encryption or hashing.
Secrets exposed in cleartext include the router administrative password, SSH server private keys, dynamic DNS provider passwords, and Simple Mail Transfer Protocol (SMTP) credentials used for email notifications. Because these values sit unencrypted in flash, any process or actor that reads the flash contents recovers them directly.
The issue is significant on consumer hardware that is frequently discarded, resold, or physically accessible in shared spaces. Credential reuse across services amplifies the impact well beyond the router itself.
Root Cause
The root cause is insecure design in how DD-WRT persists configuration secrets on this hardware. Sensitive fields are stored as plaintext strings inside NVRAM variables rather than being wrapped in a device-bound encryption scheme or replaced with salted hashes where feasible. No hardware-backed key storage is used to protect secrets at rest on the SPI flash.
Attack Vector
Exploitation requires physical access to the device. An attacker desolders or clips onto the SPI flash chip and dumps its contents using a programmer such as a CH341A or a Bus Pirate. The attacker then parses the NVRAM region of the dump to enumerate variable-value pairs.
Once extracted, cleartext credentials enable follow-on actions: authenticating to the router administrative interface, connecting over SSH using recovered private keys, hijacking dynamic DNS records, and logging into email accounts configured for router notifications. Credentials reused elsewhere expand the blast radius to third-party services.
No exploitation code is required beyond standard flash-dumping tooling and NVRAM parsers, both of which are publicly documented for the TL-WR740N platform. Refer to the GitHub Security Advisory CVE-2025-56565 for the researcher's technical write-up.
Detection Methods for CVE-2025-56565
Indicators of Compromise
- Unexpected changes to the router administrative password, SSH authorized_keys, or dynamic DNS configuration on affected devices.
- Outbound authentication attempts against SMTP or dynamic DNS providers from IP addresses unrelated to the router's normal egress.
- Unauthorized logins to third-party services that share credentials with router-stored values.
Detection Strategies
- Inspect NVRAM contents on suspect devices using nvram show and confirm which secret fields are present in cleartext.
- Compare current router configuration against a known-good baseline to identify tampering with SSH keys, admin accounts, or notification settings.
- Rotate and monitor any credentials that were ever stored on an affected router, then alert on their use from unexpected sources.
Monitoring Recommendations
- Monitor administrative interface access to the router and log all configuration changes to a central collector.
- Alert on SSH sessions to the router originating from unusual source addresses or using keys not on an approved list.
- Watch dynamic DNS accounts for record changes not initiated by legitimate administrators.
How to Mitigate CVE-2025-56565
Immediate Actions Required
- Treat any credential ever stored on an affected TL-WR740N as compromised and rotate it, including admin passwords, SSH keys, DDNS passwords, and SMTP credentials.
- Restrict physical access to the device and to any spares or decommissioned units awaiting disposal.
- Wipe NVRAM on retired hardware before resale or disposal using a full reset followed by a firmware reflash.
Patch Information
No vendor patch is referenced in the advisory at the time of publication. The TL-WR740N v1 through v4 hardware is end-of-life, and DD-WRT stores secrets in NVRAM by design on this platform. Consult the DD-WRT Wiki entry for the TP-LINK TL-WR740N for firmware status and the GitHub Security Advisory CVE-2025-56565 for remediation updates.
Workarounds
- Replace TL-WR740N v1 through v4 hardware with a supported router that offers encrypted secret storage or hardware-backed key protection.
- Do not reuse router-stored credentials on any other service, and prefer key-based SSH access with per-device keys that can be revoked in isolation.
- Physically secure the router to prevent chip-level access, and tamper-evident enclosures where feasible.
- Disable unused features that require stored credentials, such as email notifications and dynamic DNS, until migration to non-vulnerable hardware is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
