CVE-2022-24355

The TP-Link TL-WR940N router has a stack-based buffer overflow in how it parses file-name extensions: user-supplied data is copied into a fixed-length stack buffer without a length check, and network-adjacent attackers can exploit it — with no authentication — to execute code as root. This is full compromise of the router from a position on the same network segment, no credentials needed, courtesy of a classic missing-bounds-check overflow.

The scoping detail that matters is "network-adjacent": this isn't internet-wide scanning, it's an attacker who is already on the local network (a guest, a compromised device, someone on the same Wi-Fi) turning that adjacency into root on the gateway. That's a very realistic escalation in shared or lightly-segmented environments, and root on the router means traffic interception, DNS tampering, and persistence outside host defenses. The ZDI pedigree indicates a concretely analyzed, weaponizable flaw rather than a theoretical one, so where the precondition is met it's serious.

Our angle is adjacency and segmentation, since the exploit requires local reach. We'd identify any TL-WR940N on the specified build, treat any that serve untrusted or guest networks as high-priority, and pursue firmware updates while ensuring these consumer-grade devices aren't bridging trusted and untrusted segments. Where updates aren't available, the practical control is limiting who shares a network with the device — cutting the adjacency is what neutralizes an attack that can't happen remotely.