TP-Link TL-WR802N/WR841N/WR840N Authenticated Command Injection via Config Import

#!/usr/bin/env python3
"""CVE-2026-3227 Checker — TP-Link TL-WR802N/WR841N/WR840N
Checks firmware version via authenticated web scrape.
Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN
"""
import sys
import re
import requests
from requests.auth import HTTPBasicAuth

PATCHED = {
    'TL-WR802N': 'V4_260304',
    'TL-WR841N': 'V14_260303',
    'TL-WR840N': 'V6_260304',
}

def normalize_ver(v):
    # Extract numeric portion for comparison, e.g. V14_260303 -> (14, 260303)
    m = re.search(r'V?(\d+)[_.]?(\d+)', v)
    if m:
        return (int(m.group(1)), int(m.group(2)))
    return None

def main():
    if len(sys.argv) < 4:
        print('Usage: check_cve_2026_3227.py <IP> <user> <password>')
        sys.exit(2)
    ip, user, pw = sys.argv[1], sys.argv[2], sys.argv[3]
    url = f'http://{ip}/'
    try:
        r = requests.get(url, auth=HTTPBasicAuth(user, pw), timeout=10)
    except Exception as e:
        print(f'UNKNOWN — connection failed: {e}')
        sys.exit(2)
    if r.status_code == 401:
        print('UNKNOWN — authentication failed (bad credentials)')
        sys.exit(2)
    body = r.text
    # Try to find model
    model_match = re.search(r'(TL-WR(?:802|841|840)N)', body, re.IGNORECASE)
    if not model_match:
        # Try status page
        for path in ['/userRpm/StatusRpm.htm', '/cgi/info']:
            try:
                r2 = requests.get(f'http://{ip}{path}', auth=HTTPBasicAuth(user, pw), timeout=10)
                body += r2.text
            except:
                pass
        model_match = re.search(r'(TL-WR(?:802|841|840)N)', body, re.IGNORECASE)
    if not model_match:
        print('UNKNOWN — could not identify model (not TL-WR802N/841N/840N)')
        sys.exit(2)
    model = model_match.group(1).upper()
    # Find firmware version
    fw_match = re.search(r'(V\d+[_.]\d{6})', body)
    if not fw_match:
        fw_match = re.search(r'Firmware\s*Version[^\d]*(\d+\.\d+\.\d+)', body)
    if not fw_match:
        print(f'UNKNOWN — found model {model} but could not extract firmware version')
        sys.exit(2)
    fw_raw = fw_match.group(1)
    fw_tuple = normalize_ver(fw_raw)
    patched_raw = PATCHED.get(model)
    if not patched_raw:
        print(f'UNKNOWN — model {model} not in affected list')
        sys.exit(2)
    patched_tuple = normalize_ver(patched_raw)
    if fw_tuple is None or patched_tuple is None:
        print(f'UNKNOWN — could not parse versions (fw={fw_raw}, patched={patched_raw})')
        sys.exit(2)
    if fw_tuple >= patched_tuple:
        print(f'PATCHED — {model} firmware {fw_raw} >= {patched_raw}')
        sys.exit(0)
    else:
        print(f'VULNERABLE — {model} firmware {fw_raw} < {patched_raw} (CVE-2026-3227)')
        sys.exit(1)

if __name__ == '__main__':
    main()