CVE-2020-28877
Buffer overflow in in the copy_msg_element function for the devDiscoverHandle server in the TP-Link WR and WDR series, including WDR7400, WDR7500, WDR7660, WDR7800, WDR8400, WDR8500, WDR8600, WDR8620, WDR8640, WDR8660, WR880N, WR886N, WR890N, WR890N,…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.20%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Buffer overflow in in the copy_msg_element function for the devDiscoverHandle server in the TP-Link WR and WDR series, including WDR7400, WDR7500, WDR7660, WDR7800, WDR8400, WDR8500, WDR8600, WDR8620, WDR8640, WDR8660, WR880N, WR886N, WR890N, WR890N, WR882N, and WR708N.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.20% probability · 68th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-120
- Affected
- tp-link/wdr7400 firmware · tp-link/wdr7500 firmware · tp-link/wdr7660 firmware · tp-link/wdr7800 firmware · tp-link/wdr8400 firmware · tp-link/wdr8500 firmware · tp-link/wdr8600 firmware · tp-link/wdr8620 firmware · tp-link/wdr8640 firmware · tp-link/wdr8660 firmware · tp-link/wr880n firmware · tp-link/wr886n firmware · tp-link/wr890n firmware · tp-link/wr882n firmware · tp-link/wr708n firmware
- Source
- cve@mitre.org
EPSS 1.2% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://github.com/peanuts62/TP-Link-pocBroken Link
- https://exchange.xforce.ibmcloud.com/vulnerabilities/192112Third Party Advisory
- https://github.com/peanuts62/TP-Link-pocBroken Link
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.