TP-Link Tapo/Kasa CVE-2024-46548 MQTT MITM Vulnerability Analysis

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability ID: CVE-2024-46548 2. Affected Devices: TP-Link Tapo P125M version 1.0.2 and Kasa KP125M version 1.0.3 3. Vulnerability Description: - The device improperly validates certificates, allowing remote unauthenticated attackers to perform man-in-the-middle (MITM) attacks to eavesdrop on encrypted communications, extract account credentials, device configurations, intercept conversations, and unbind devices from existing accounts. - Affected devices use MQTT to interact with remote servers for status reporting and remote user control. Since the affected devices do not validate the remote server’s certificate, attackers can intercept traffic, perform injections, take control of affected devices, and retrieve device status. - Unbinding and binding commands enable attackers to intercept credentials and log into TP-Link web services, thereby expanding the scope of impact. 4. Reproduction Steps: 1. Set up network DNS redirection to a PC acting as a proxy. 2. Use tools such as tcpproxy for TLS proxying and Wireshark for traffic analysis. 3. Capture and decrypt MQTT traffic. 4. Extract MQTT login credentials and device information. 5. Inject malicious MQTT messages to control or unbind the device. Wait for the user to re-bind the device and extract account credentials. 5. Analysis: - CVSS Score: 3.0, 8.8, High - Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - AV (Attack Vector): Network. Attackers can exploit this vulnerability at any node between the device and TP-Link cloud services, such as ISPs or IDCs. - PR (Privileges Required): None. Attackers do not need any user or admin privileges to exploit TP-Link products. - S (Scope): Changed. Attackers can inject messages and affect information displayed in the mobile app. They can also log in to TP-Link websites and forms using extracted credentials. Attackers can retrieve, modify, or delete account information. - AC (Attack Complexity): Low. The attack is easy to replicate and automate, and can be consistently reproduced. - CIA (Confidentiality, Integrity, Availability): High. Device information can be revealed and tampered with. Attackers can render devices inaccessible, though the devices themselves are not physically damaged. Attackers can steal TP-Link credentials from newly paired devices or deliberately unpaired existing devices, forcing users to re-pair and enabling credential eavesdropping. Once account passwords are obtained, user personal information can be retrieved, modified, or deleted. 6. History: - June 2024: Reported to TP-Link. - June 2024: Vendor confirmed the issue. - August 2024: Confirmed resolved in firmware provided by the vendor. 7. Contributors: - @Chapoly1305 - @agatah2333 This information provides a detailed description of the vulnerability’s nature, impact scope, reproduction steps, security risks, and remediation actions taken.

Goal Reached Thanks to every supporter — we hit 100%!

TP-Link Tapo/Kasa CVE-2024-46548 MQTT MITM Vulnerability Analysis

More from this source