Researcher Develops Kernel Exploit for TP-Link EAP770 to Disable Faulty Qualcomm SFE Offload
A researcher purchased the TP-Link EAP770 v1 Wi-Fi 7 access point in August 2023 and later encountered repeated data corruption during large file transfers over Wi-Fi. Downloads of ISO images and Nix binary cache files frequently failed with bad record mac errors in TLS and SSH, while TCP checksums remained valid because the hardware offload recalculated them after corruption occurred.
Analysis showed that 64-byte blocks were being overwritten in packets traveling from LAN to Wi-Fi. The corruption matched the cache line size of the Qualcomm IPQ9574 processor and was traced to the qca-nss-dp driver failing to invalidate the CPU cache before returning receive buffers to the NIC. The SFE/PPE offload engine then processed the already-damaged data.
TP-Link had discontinued firmware support for the EAP770 v1 even before the device left the factory. The only available workaround required writing two zeros to /sys/sfe/l2_feature and /sys/sfe/ppe_rfs_feature, but the device's SSH shell runs as uid 1 without privileges and no GUI option existed.
To obtain the necessary root access, the researcher chained CVE-2022-0185 with pipe buffer manipulation. The exploit first isolates a user namespace, triggers a slab overflow, leaks kernel pointers via an enlarged key object, and finally overwrites modprobe_path to execute a privileged binary. The payload was carefully designed to keep the device stable after a single successful run.
Development was performed iteratively with AI assistance over seventeen hours. Kernel sources from the related EAP783 model were used to build a matching QEMU test environment because TP-Link never published GPL sources for the v1 hardware. After successful exploitation on the real device, disabling the offload features eliminated the data corruption.
Related articles
Nightmare Eclipse Publishes SignDrop Zero-Day in Windows CLFS Driver
Security researcher Abdelhamid Naseri, known as Nightmare Eclipse, has disclosed a new zero-day vulnerability named SignDrop affecting the Common Log File System (CLFS) driver in Windows. The flaw allows attackers to bypass authentication protections introduced by Microsoft in October 2025 and escalate privileges on affected systems. SignDrop exploits the way CLFS handles .cnpf authentication file creation when a new log file is generated, enabling a privileged process to open the file later and create it with SYSTEM rights. The technique can also be abused against any antivirus or EDR engine to disable self-protection mechanisms by making file creation requests appear to originate from the legitimate security process itself. Nightmare Eclipse confirmed the issue works on Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental, impacting an estimated 80 percent of Windows installations. No workaround exists other than waiting for a Microsoft patch, as disabling CLFS protections would reintroduce memory corruption risks. The researcher previously released multiple other zero-days, including BigDiskBuster and RoguePlanet targeting Microsoft Defender.
Telegram Patches RCE Vulnerabilities in HTML Widgets After Researcher Demonstrates Calculator Exploit
Telegram introduced HTML widgets for bots in early November, allowing JavaScript execution inside messages via the QuickJS engine. Security researcher V12 quickly demonstrated remote code execution by launching the system calculator on Android. Pavel Durov responded that no vulnerability existed because the user had to first start the bot, yet server-side fixes were deployed anyway. Multiple use-after-free and use-after-return bugs were identified in QuickJS and QuickJS-ng, some discovered with AI assistance from Claude Fable 5.1 and Mythos 5.2. Telegram isolated the widget engine into a separate process on Android, added syscall filtering, and limited nested graphical effects to prevent crashes. Desktop clients received the fixes across versions 7.4.2 and 7.4.3, while widgets were temporarily restricted server-side. Users are advised to update to Android 13.2.2 or Desktop 7.4.3 and avoid unknown bots.
Telegram Patches Critical QuickJS Sandbox Escape Vulnerability in Android Update 13.2.2
Telegram has released version 13.2.2 for Android to address a high-severity vulnerability in its HTML widgets for bots. The flaw resided in the QuickJS JavaScript engine within Telegram's QuickJS-ng fork and allowed scripts in ordinary messages to break out of the sandbox and execute native code on the device. The root cause was improper handling of the await using construct inside non-async functions, which triggered a use-after-return condition by freeing local variable references while nested functions still accessed the stack. The vulnerable code entered the QuickJS-ng main branch on May 16 as part of explicit resource management support. Security researcher Andreas Rösler discovered the issue during an AI-assisted audit with Anthropic's Claude model that identified 27 findings total. The patch enforces a syntax error on the invalid construct and was merged on November 10, the same day the Android release became available. Although reported against Android 13.2.1, the bug affected every platform using the affected engine fork.
Node.js Patches 16 Vulnerabilities Exposing TLS Private Keys and Cross-Connection Data
The Node.js project has released fixes addressing 16 vulnerabilities, seven of which are rated high severity. The most critical issue, CVE-2026-123864, allows an unauthenticated client to read memory from other HTTPS connections, potentially exposing TLS private keys and requests belonging to other users. Three supported release lines were affected, and exploitation requires a specific application code pattern involving res.flushHeaders() and res.end() calls before the request body is fully received. Additional high-severity flaws include CVE-2026-123863, which crashes HTTP/2 servers, CVE-2026-123866 that leaks server memory chunks to clients, and CVE-2026-123865 that causes permanent memory and file descriptor leaks in HTTP/2 servers. Several other CVEs affect TLS renegotiation, SNI callbacks, and file streaming functions. The project states that end-of-life branches including 20.x and 25.x remain vulnerable with no patches available.