HighPublic exploit

Denial of Service in TP-Link VN020 F3v(T) WANIPConnection SOAP Handler

IdentifiersCVE-2024-12342CWE-703

CVE-2024-12342 is a critical denial-of-service vulnerability affecting TP-Link VN020 F3v(T) devices running firmware TT_V6.2.1021. The issue is reported in unknown processing of the /control/WANIPConnection endpoint within the device's incomplete SOAP request handler. A crafted or malformed SOAP request to this handler can trigger the flaw and cause the affected device or service to become unavailable. The precise vulnerable function or code path is not provided in the available information.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation causes denial of service on the affected TP-Link VN020 F3v(T) device or the vulnerable WANIPConnection service, resulting in loss of availability. Based on the available information, no evidence is provided for code execution, privilege escalation, or data disclosure; the documented impact is service disruption only.

Mitigation

If you can’t patch tonight, do this now.

Restrict access to the device management and SOAP control interfaces, especially /control/WANIPConnection, to trusted administrative hosts only. Ensure the vulnerable interface is not exposed beyond the local network, segment management access onto a dedicated administration VLAN or subnet, and use firewall or ACL rules to block untrusted internal hosts from reaching the router's control plane. Where operationally feasible, disable UPnP or related SOAP-exposed management functionality if it is not required.

Remediation

Patch, then assume compromise.

Upgrade to a vendor-provided fixed firmware version if one is available from TP-Link. If no patched release is currently available, monitor TP-Link security advisories and apply the first firmware update that addresses CVE-2024-12342. Because the available information identifies firmware TT_V6.2.1021 as affected, remediation should prioritize moving affected devices off that version once a fix exists.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).

VALID 1 / 2 TOTALView more in app

TPLink-VN020-DoSMaturityPoCVerified exploit

This repository contains two Python scripts (CVE-2024-12342.py and TPLink_DOS_CVE-2024-12342.py) and a README file. Both scripts are designed to exploit CVE-2024-12342, a denial of service vulnerability affecting TP-Link VN020-F3v routers. The main script, CVE-2024-12342.py, sends a SOAP SetConnectionType request with an extremely large string in the <NewConnectionType> field to the device's UPnP WANIPConnection control endpoint, potentially causing the service to crash. The secondary script, TPLink_DOS_CVE-2024-12342.py, sends a SOAP AddPortMapping request to the same endpoint, likely for testing or as an alternative DoS vector. Both scripts require the attacker to specify the target IP and (optionally) port, defaulting to 5431, which is commonly used for UPnP. The exploit is a proof-of-concept and does not provide post-exploitation capabilities. The README provides basic usage instructions. No hardcoded IPs or credentials are present; the scripts are intended for direct targeting of vulnerable devices on the network.

becrevexDisclosed Apr 29, 2025pythonnetwork

ACTIVITY FEED

Recent activity

2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

2 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2