CVE-2024-1179 is a High severity stack based buffer overflow in the DHCPv6 client options handling of the TP-Link Omada ER605 router. The record scores it 8.8, the ZDI advisory 7.5. ZDI lists firmware ER605(UN)_V2_2.2.4 Build 20240119 as the fix. Update the router.
What's affected
The record lists the Omada ER605 firmware and the ER605 version 2.0 hardware. ZDI advisory ZDI-24-085 does not give an affected version range. It names the fixed firmware as ER605(UN)_V2_2.2.4 Build 20240119.
The two sources disagree on severity. The record gives 8.8 (High). ZDI gives 7.5 (also High) with vector AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, where the attack is from an adjacent network and complexity is high. The NVD vector appears to rate the attack as easier, so both are shown here. Either way the rating is High.
How to check if you're exposed
Sign in to the router's management page or the Omada controller and read the firmware version. Compare it with ER605(UN)_V2_2.2.4 Build 20240119.
In the Omada controller, the device list shows the firmware for each gateway. Note that the ZDI advisory names the fix for the UN hardware version 2, so confirm the right firmware line for your model and region with TP-Link.
What to do now
- List every ER605 in use and its hardware version and firmware.
- Update to firmware ER605(UN)_V2_2.2.4 Build 20240119 or later, from TP-Link.
- Keep untrusted devices off the network segment facing the router's WAN or DHCPv6 side where you can, since the attack is from an adjacent network.
- Back up the configuration before upgrading, and schedule the change in a quiet window.
- Check that the management interface is not exposed to the internet.
Why it matters
The class is a stack based buffer overflow, CWE-121 with an out of bounds write, CWE-787. The router copies DHCP option data of a length the sender controls into a fixed size buffer without checking, according to ZDI. The code runs as root, so the result is complete control of the device. No login is needed.
A router is the network's front door, so a compromise exposes the traffic and the internal network behind it. The adjacent network requirement narrows who can attack, but not by much on a shared segment. The record's KEV flag is false.
Quick check
Which firmware fixes CVE-2024-1179?
ZDI names ER605(UN)_V2_2.2.4 Build 20240119.
Why do the scores differ?
The record says 8.8 and ZDI says 7.5 with a high complexity rating. Both put it in the High band.
Sources
Last reviewed: 19 October 2026.
