CVSS: 9.0EPSS: 0%CPEs: 76EXPL: 2CVE-2017-15630 – TP-Link Remote Command Injection
https://notcve.org/view.php?id=CVE-2017-15630
11 Jan 2018 — TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-remotesubnet variable in the pptp_client.lua file. Los dispositivos TP-Link WVR, WAR y ER permiten que administradores autenticados remotos ejecuten comandos arbitrarios mediante inyección de comandos en la variable new-remotesubnet en el archivo pptp_client.lua. Many TP-Link products suffer from multiple authenticated remote command injection vulnerabilities. • http://www.securityfocus.com/archive/1/541655/100/0/threaded •
CVSS: 9.0EPSS: 0%CPEs: 76EXPL: 2CVE-2017-15637 – TP-Link Remote Command Injection
https://notcve.org/view.php?id=CVE-2017-15637
11 Jan 2018 — TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the pptphellointerval variable in the pptp_server.lua file. Los dispositivos TP-Link WVR, WAR y ER permiten que administradores autenticados remotos ejecuten comandos arbitrarios mediante inyección de comandos en la variable pptphellointerval en el archivo pptp_server.lua. Many TP-Link products suffer from multiple authenticated remote command injection vulnerabilities. • http://www.securityfocus.com/archive/1/541655/100/0/threaded •
CVSS: 9.0EPSS: 0%CPEs: 76EXPL: 2CVE-2017-15636 – TP-Link Remote Command Injection
https://notcve.org/view.php?id=CVE-2017-15636
11 Jan 2018 — TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-time variable in the webfilter.lua file. Los dispositivos TP-Link WVR, WAR y ER permiten que administradores autenticados remotos ejecuten comandos arbitrarios mediante inyección de comandos en la variable new-time en el archivo webfilter.lua. Many TP-Link products suffer from multiple authenticated remote command injection vulnerabilities. • http://www.securityfocus.com/archive/1/541655/100/0/threaded •
CVSS: 9.0EPSS: 0%CPEs: 76EXPL: 2CVE-2017-15618 – TP-Link Remote Command Injection
https://notcve.org/view.php?id=CVE-2017-15618
11 Jan 2018 — TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-enable variable in the pptp_client.lua file. Los dispositivos TP-Link WVR, WAR y ER permiten que administradores autenticados remotos ejecuten comandos arbitrarios mediante inyección de comandos en la variable new-enable en el archivo pptp_client.lua. Many TP-Link products suffer from multiple authenticated remote command injection vulnerabilities. • http://www.securityfocus.com/archive/1/541655/100/0/threaded •
CVSS: 9.0EPSS: 0%CPEs: 76EXPL: 2CVE-2017-15622 – TP-Link Remote Command Injection
https://notcve.org/view.php?id=CVE-2017-15622
11 Jan 2018 — TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-mppeencryption variable in the pptp_client.lua file. Los dispositivos TP-Link WVR, WAR y ER permiten que administradores autenticados remotos ejecuten comandos arbitrarios mediante inyección de comandos en la variable new-mppeencryption en el archivo pptp_client.lua. Many TP-Link products suffer from multiple authenticated remote command injection vulnerabilities. • http://www.securityfocus.com/archive/1/541655/100/0/threaded •
CVSS: 9.0EPSS: 0%CPEs: 110EXPL: 1CVE-2017-16958
https://notcve.org/view.php?id=CVE-2017-16958
27 Nov 2017 — TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the t_bindif field of an admin/bridge command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/bridge.lua in uhttpd. Los dispositivos TP-Link TL-WVR, TL-WAR, TL-ER y TL-R permiten que usuarios autenticados remotos ejecuten comandos arbitrarios mediante metacaracteres shell en el campo t_bindif de un comando admin/bridge en cg... • https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkBridgeAuthenticatedRCE.txt • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 110EXPL: 1CVE-2017-16957
https://notcve.org/view.php?id=CVE-2017-16957
27 Nov 2017 — TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the iface field of an admin/diagnostic command to cgi-bin/luci, related to the zone_get_effect_devices function in /usr/lib/lua/luci/controller/admin/diagnostic.lua in uhttpd. Los dispositivos TP-Link TL-WVR, TL-WAR, TL-ER y TL-R permiten que usuarios autenticados remotos ejecuten comandos arbitrarios mediante metacaracteres shell en el campo iface de un comando admin/di... • http://www.securityfocus.com/bid/101968 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 98EXPL: 0CVE-2017-16960
https://notcve.org/view.php?id=CVE-2017-16960
27 Nov 2017 — TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the t_bindif field of an admin/interface command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/interface.lua in uhttpd. Los dispositivos TP-Link TL-WVR, TL-WAR, TL-ER y TL-R permiten que usuarios autenticados remotos ejecuten comandos arbitrarios mediante metacaracteres shell en el campo t_bindif de un comando admin/interf... • https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkInterfaceAuthenticatedRCE.txt • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.5EPSS: 2%CPEs: 110EXPL: 1CVE-2017-16959
https://notcve.org/view.php?id=CVE-2017-16959
27 Nov 2017 — The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence of arbitrary files by making an operation=write;locale=%0d request, and then making an operation=read request with a crafted Accept-Language HTTP header, related to the set_sysinfo and get_sysinfo functions in /usr/lib/lua/luci/controller/locale.lua in uhttpd. La característica locale en cgi-bin/luci en dispositivos TP-Link TL-WVR, TL-WAR, TL-ER y TL-R permite que... • https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkLocalePathDisclosure.txt • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •