CVSS: 9.0EPSS: 0%CPEs: 110EXPL: 1CVE-2017-16957
https://notcve.org/view.php?id=CVE-2017-16957
TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the iface field of an admin/diagnostic command to cgi-bin/luci, related to the zone_get_effect_devices function in /usr/lib/lua/luci/controller/admin/diagnostic.lua in uhttpd. Los dispositivos TP-Link TL-WVR, TL-WAR, TL-ER y TL-R permiten que usuarios autenticados remotos ejecuten comandos arbitrarios mediante metacaracteres shell en el campo iface de un comando admin/diagnostic en cgi-bin/luci. Esto se relaciona con la función zone_get_effect_devices en /usr/lib/lua/luci/controller/admin/diagnostic.lua en uhttpd. • http://www.securityfocus.com/bid/101968 https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkDiagnosticAuthenticatedRCE.txt • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 98EXPL: 0CVE-2017-16960
https://notcve.org/view.php?id=CVE-2017-16960
TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the t_bindif field of an admin/interface command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/interface.lua in uhttpd. Los dispositivos TP-Link TL-WVR, TL-WAR, TL-ER y TL-R permiten que usuarios autenticados remotos ejecuten comandos arbitrarios mediante metacaracteres shell en el campo t_bindif de un comando admin/interface en cgi-bin/luci. Esto se relaciona con la función get_device_byif en /usr/lib/lua/luci/controller/admin/interface.lua en uhttpd. • https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkInterfaceAuthenticatedRCE.txt • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 69%CPEs: 2EXPL: 2CVE-2017-13772 – TP-Link WDR4300 - Remote Code Execution (Authenticated)
https://notcve.org/view.php?id=CVE-2017-13772
Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated users to execute arbitrary code via the (1) ping_addr parameter to PingIframeRpm.htm or (2) dnsserver2 parameter to WanStaticIpV6CfgRpm.htm. Múltiples desbordamientos de búfer basados en pila en routers WiFi TP-Link WR940N con la versión 4 de hardware permiten que usuarios autenticados remotos ejecuten código arbitrario mediante (1) el parámetro ping_addr en PingIframeRpm.htm o (2) el parámetro dnsserver2 en WanStaticIpV6CfgRpm.htm. Numerous remote code execution paths were discovered in TP-Link's WR940N home WiFi router. Valid credentials are required for this attack path. It is possible for an authenticated attacker to obtain a remote shell with root privileges. • https://www.exploit-db.com/exploits/48994 https://www.exploit-db.com/exploits/43022 http://packetstormsecurity.com/files/158999/TP-Link-WDR4300-Remote-Code-Execution.html https://www.fidusinfosec.com/tp-link-remote-code-execution-cve-2017-13772 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 2CVE-2017-15291 – TP-Link TL-MR3220 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-15291
Cross-site scripting (XSS) vulnerability in the Wireless MAC Filtering page in TP-LINK TL-MR3220 wireless routers allows remote attackers to inject arbitrary web script or HTML via the Description field. Vulnerabilidad de Cross-Site Scripting (XSS) en la página Wireless MAC Filtering en los routers inalámbricos TP-LINK TL-MR3220 permite que atacantes remotos inyecten scripts web o HTML arbitrarios mediante el campo Description. • https://www.exploit-db.com/exploits/43023 https://fireshellsecurity.team/assets/pdf/Router-TP-LINK-TL-MR3220-Vulnerability-XSS.pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 2CVE-2017-11519
https://notcve.org/view.php?id=CVE-2017-11519
passwd_recovery.lua on the TP-Link Archer C9(UN)_V2_160517 allows an attacker to reset the admin password by leveraging a predictable random number generator seed. This is fixed in C9(UN)_V2_170511. El archivo passwd_recovery.lua en TP-Link Archer versión C9 (UN) _V2_160517, permite a un atacante restablecer la contraseña de administrador al aprovechar un seed generador de números aleatorios predecible. Esto se soluciona en versión C9 (UN) _V2_170511. • https://github.com/vakzz/tplink-CVE-2017-11519 http://www.tp-link.com/en/download/Archer-C9_V2.html#Firmware https://devcraft.io/posts/2017/07/21/tp-link-archer-c9-admin-password-reset.html • CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) •