Multiple TP-Link Routers: Hardcoded Configuration Encryption Key

The device configuration is encrypted with DES under a key that can be reconstructed entirely from the firmware image. Two constant keys are compiled into libcmm.so. The first decrypts a data-model file that ships in the firmware and yields the device’s product identifier. The second is XORed with that product identifier to produce the configuration (backup and restore) key. Both constants are the same on every unit, and the product identifier is itself derivable from a shipped file, so the configuration key for a given device can be computed offline.

Technical Details

Data-model key

The exported function dm_decryptFile (0x19D408) decrypts the bundled /etc/reduced_data_model.xml (path string at 0x2420E8) with a constant DES key held in a local variable and passed to the imported DES routine cen_desMinDo:

key = 0xCBD2E3F90FA58D47;                       // constant DES key (bytes 47 8D A5 0F F9 E3 D2 CB)
n = cen_desMinDo(inBuf, inLen, outBuf, outLen, &key, 0);

The decrypted data model contains the device’s product identifier, read elsewhere through the exported accessor dm_getObj (0x18C5BC).

Configuration key

The function at getBackNRestoreK (0x646E8) builds the configuration key. It starts from a second constant, reads the device-info object with dm_getObj, formats the product-identifier field as eight ASCII hex characters with "%08x", and XORs those eight bytes into the constant:

key = 0xCF2D3EF90BA58D74;                        // constant base key (bytes 74 8D A5 0B F9 3E 2D CF)
dm_getObj(2, ..., devInfo);                      // read the device-info object
snprintf(tmp, 16, "%08x", devInfo_productId);    // product id as 8 hex chars
for ( i = 0; i < 8; ++i )
    ((char *)&key)[i] ^= tmp[i];                 // final DES key = base XOR ascii_hex(productId)

Both constants (0xCBD2E3F90FA58D47 and 0xCF2D3EF90BA58D74) are fixed in the binary and identical across devices. The only per-device input is the product identifier, which the first key recovers from a file present in every firmware image. The configuration key is therefore not secret with respect to anyone holding the firmware.

Impact

An attacker who obtains a device’s configuration file and a copy of the firmware (available from the vendor’s download site) can decrypt the configuration, modify it, and re-encrypt it so the device accepts it. This exposes all stored settings and credential material and lets the attacker craft a configuration of their choosing.

Disclosure timeline

References

• TP-Link Security Advisory www.tp-link.com/us/support/faq/5027/