Executive brief
DD-WRT firmware used on TP-Link TL-WR740N wireless routers stores authentication credentials—including admin passwords, SSH keys, and third-party service credentials—unencrypted in the device's flash memory. An attacker with physical access to the router can read these credentials directly from the flash chip using commodity hardware, gaining full control of the device, network access, and accounts with external services. This is a significant risk for devices in unattended locations or hardware that changes hands without secure erasure.
Technical details
The vulnerability is a cleartext storage flaw (CWE-312, CWE-316) in the NVRAM configuration store used by DD-WRT firmware. Sensitive credentials—including SSH private keys, dynamic DNS passwords, email notification accounts, and administrative passwords—are written to the SPI flash memory without encryption or obfuscation. An attacker with physical access can extract the entire flash contents using an SPI programmer (e.g., CH341A) and recover plaintext credential strings without authentication or device power-on. No administrative password knowledge is required, and the extraction leaves no device logs. The recovered credentials may grant access to external systems and services beyond the router itself, including SSH-protected infrastructure and third-party accounts.
Affected products
- DD-WRT DD-WRT firmware all builds for TP-Link TL-WR740N v1, v2, v3, and v4
- TP-Link TL-WR740N v1, v2, v3, v4
Timeline
- 2025-07-28: disclosed: Vulnerability discovered
- 2025-08-01: other: Technical validation completed
- 2025-08-02: other: Vendor notified (security@dd-wrt.com)
- 2025-08-28: other: CVE ID assigned by MITRE
- 2026-08-14: advisory: Public disclosure