CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2017-17745 – TP-Link TL-SG108E XSS / Weak Access Control
https://notcve.org/view.php?id=CVE-2017-17745
Cross-site scripting (XSS) vulnerability in system_name_set.cgi in TP-Link TL-SG108E 1.0.0 allows authenticated remote attackers to submit arbitrary java script via the 'sysName' parameter. Vulnerabilidad Cross-Site Scripting (XSS) en system_name_set.cgi en TP-Link TL-SG108E 1.0.0 permite que atacantes remotos envíen scripts java arbitrarios mediante el parámetro sysName. TP-Link TL-SG108E with firmware 1.0.0 Build 20160722 Rel.50167 suffers from cross site scripting and weak access control vulnerabilities. • http://seclists.org/fulldisclosure/2017/Dec/67 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 1CVE-2017-17747 – TP-Link TL-SG108E XSS / Weak Access Control
https://notcve.org/view.php?id=CVE-2017-17747
Weak access controls in the Device Logout functionality on the TP-Link TL-SG108E v1.0.0 allow remote attackers to call the logout functionality, triggering a denial of service condition. Controles de acceso débiles en la funcionalidad de cierre de sesión del dispositivo en TP-Link TL-SG108E v1.0.0 permiten a los atacantes remotos llamar a la funcionalidad de cierre de sesión, desencadenando una condición de denegación de servicio. TP-Link TL-SG108E with firmware 1.0.0 Build 20160722 Rel.50167 suffers from cross site scripting and weak access control vulnerabilities. • http://seclists.org/fulldisclosure/2017/Dec/67 • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.0EPSS: 0%CPEs: 30EXPL: 1CVE-2017-17758
https://notcve.org/view.php?id=CVE-2017-17758
TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/dhcps command to cgi-bin/luci, related to the zone_get_iface_bydev function in /usr/lib/lua/luci/controller/admin/dhcps.lua in uhttpd. Los dispositivos TL-WVR y TL-WAR de TP-Link permiten que usuarios autenticados remotos ejecuten comandos arbitrarios mediante metacaracteres shell en el campo interface de un comando admin/dhcps en cgi-bin/luci. Esto se relaciona con la función zone_get_iface_bydev en /usr/lib/lua/luci/controller/admin/dhcps.lua en uhttpd. • https://github.com/L1ZhaoXin/Router-Vulnerability-Research/blob/master/Tplink_LUCI_Dhcps_Authenticated_RCE_Record.txt • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 30EXPL: 1CVE-2017-17757
https://notcve.org/view.php?id=CVE-2017-17757
TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/wportal command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/wportal.lua in uhttpd. Los dispositivos TL-WVR y TL-WAR de TP-Link permiten que usuarios autenticados remotos ejecuten comandos arbitrarios mediante metacaracteres shell en el campo interface de un comando admin/wportal en cgi-bin/luci. Esto se relaciona con la función get_device_byif en /usr/lib/lua/luci/controller/admin/wportal.lua en uhttpd. • https://github.com/L1ZhaoXin/Router-Vulnerability-Research/blob/master/Tplink_LUCI_Wechat_Authenticated_RCE_Record.txt • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.5EPSS: 4%CPEs: 110EXPL: 1CVE-2017-16959
https://notcve.org/view.php?id=CVE-2017-16959
The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence of arbitrary files by making an operation=write;locale=%0d request, and then making an operation=read request with a crafted Accept-Language HTTP header, related to the set_sysinfo and get_sysinfo functions in /usr/lib/lua/luci/controller/locale.lua in uhttpd. La característica locale en cgi-bin/luci en dispositivos TP-Link TL-WVR, TL-WAR, TL-ER y TL-R permite que usuarios autenticados remotos examinen la existencia de archivos arbitrarios haciendo una petición operation=write;locale=%0d y, a continuación, haciendo una petición operation=read con una cabecera HTTP Accept-Language manipulada. Esto se relaciona con las funciones set_sysinfo y get_sysinfo en /usr/lib/lua/luci/controller/locale.lua en uhttpd. • https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkLocalePathDisclosure.txt • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •