CVSS: 7.5EPSS: 3%CPEs: 2EXPL: 3CVE-2018-18428 – TP-Link TL-SC3130 1.6.18 - RTSP Stream Disclosure
https://notcve.org/view.php?id=CVE-2018-18428
TP-Link TL-SC3130 1.6.18P12_121101 devices allow unauthenticated RTSP stream access, as demonstrated by a /jpg/image.jpg URI. Los dispositivos TP-Link TL-SC3130 1.6.18P12_121101 permiten el acceso no autenticado al flujo RTSP, tal y como queda demostrado con un URI /jpg/image.jpg. TP-Link TL-SC3130 version 1.6.18 suffers from an unauthenticated and unauthorized live RTSP stream disclosure. • https://www.exploit-db.com/exploits/45632 https://packetstormsecurity.com/files/149843 https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5497.php • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.1EPSS: 0%CPEs: 5EXPL: 2CVE-2013-2580 – TP-Link TL-SC3171 IP Cameras - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-2580
Unrestricted file upload vulnerability in cgi-bin/uploadfile in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6, allows remote attackers to upload arbitrary files, then accessing it via a direct request to the file in the mnt/mtd directory. Vulnerabilidad de subida de ficheros sin restricción en cgi-bin/uploadfile de TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, y posiblemente otros modelos anteriores al firmware en beta LM.1.6.18P12_sign6, permite a atacantes remotos subir archivos arbitrarios, posteriormente acceder a ellos a través de una petición directa al archivo en el directorio mnt/mtd. • https://www.exploit-db.com/exploits/27289 http://www.coresecurity.com/advisories/multiple-vulnerabilities-tp-link-tl-sc3171-ip-cameras •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 2CVE-2013-2581 – TP-Link TL-SC3171 IP Cameras - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-2581
cgi-bin/firmwareupgrade in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6 allows remote attackers to modify the firmware revision via a "preset" action. cgi-bin/firmwareupgrade en cámaras IP TP-Link TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G y posiblemente en otros modelos anteriores al firmware beta LM.1.6.18P12_sign6 permite a atacantes remotos modificar la revisión del firmware a través de una acción "preset". • https://www.exploit-db.com/exploits/27289 http://secunia.com/advisories/54155 http://www.coresecurity.com/advisories/multiple-vulnerabilities-tp-link-tl-sc3171-ip-cameras • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 2%CPEs: 5EXPL: 2CVE-2013-2578 – TP-Link TL-SC3171 IP Cameras - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-2578
cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6 allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the ServerName parameter and (2) other unspecified parameters. cgi-bin/admin/servetest en cámaras IP TP-Link TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G y posiblemente otros modelos anteriores al firmware beta LM.1.6.18P12_sign6 permite a atacantes remotos ejecutar comandos de forma arbitraria a través de metacaracteres shell en (1) el parámetro Servername y (2) otros parámetros no especificados. • https://www.exploit-db.com/exploits/27289 http://www.coresecurity.com/advisories/multiple-vulnerabilities-tp-link-tl-sc3171-ip-cameras • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 2CVE-2013-2579 – TP-Link TL-SC3171 IP Cameras - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-2579
TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6 have an empty password for the hardcoded "qmik" account, which allows remote attackers to obtain administrative access via a TELNET session. Las cámaras IP TP-Link TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, y posiblemente otros modelos anteriores al firmware beta LM.1.6.18P12_sign6 tienen una contraseña vacía para la cuenta incrustada en el código "qmik", lo que permite a atacantes remotos obtener acceso administrativo a través de una sesion TELNET. • https://www.exploit-db.com/exploits/27289 http://www.coresecurity.com/advisories/multiple-vulnerabilities-tp-link-tl-sc3171-ip-cameras • CWE-255: Credentials Management Errors •