CVSS: 7.1EPSS: 0%CPEs: 5EXPL: 2CVE-2013-2580 – TP-Link TL-SC3171 IP Cameras - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-2580
Unrestricted file upload vulnerability in cgi-bin/uploadfile in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6, allows remote attackers to upload arbitrary files, then accessing it via a direct request to the file in the mnt/mtd directory. Vulnerabilidad de subida de ficheros sin restricción en cgi-bin/uploadfile de TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, y posiblemente otros modelos anteriores al firmware en beta LM.1.6.18P12_sign6, permite a atacantes remotos subir archivos arbitrarios, posteriormente acceder a ellos a través de una petición directa al archivo en el directorio mnt/mtd. • https://www.exploit-db.com/exploits/27289 http://www.coresecurity.com/advisories/multiple-vulnerabilities-tp-link-tl-sc3171-ip-cameras •
CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 2CVE-2013-2579 – TP-Link TL-SC3171 IP Cameras - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-2579
TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6 have an empty password for the hardcoded "qmik" account, which allows remote attackers to obtain administrative access via a TELNET session. Las cámaras IP TP-Link TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, y posiblemente otros modelos anteriores al firmware beta LM.1.6.18P12_sign6 tienen una contraseña vacía para la cuenta incrustada en el código "qmik", lo que permite a atacantes remotos obtener acceso administrativo a través de una sesion TELNET. • https://www.exploit-db.com/exploits/27289 http://www.coresecurity.com/advisories/multiple-vulnerabilities-tp-link-tl-sc3171-ip-cameras • CWE-255: Credentials Management Errors •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 2CVE-2013-2581 – TP-Link TL-SC3171 IP Cameras - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-2581
cgi-bin/firmwareupgrade in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6 allows remote attackers to modify the firmware revision via a "preset" action. cgi-bin/firmwareupgrade en cámaras IP TP-Link TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G y posiblemente en otros modelos anteriores al firmware beta LM.1.6.18P12_sign6 permite a atacantes remotos modificar la revisión del firmware a través de una acción "preset". • https://www.exploit-db.com/exploits/27289 http://secunia.com/advisories/54155 http://www.coresecurity.com/advisories/multiple-vulnerabilities-tp-link-tl-sc3171-ip-cameras • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.1EPSS: 0%CPEs: 5EXPL: 1CVE-2013-3688 – TP-LINK TL-SC3171 Authentication Bypass
https://notcve.org/view.php?id=CVE-2013-3688
The TP-Link IP Cameras TL-SC3171, TL-SC3130, TL-SC3130G, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6, does not properly restrict access to certain administrative functions, which allows remote attackers to (1) cause a denial of service (device reboot) via a request to cgi-bin/reboot or (2) cause a denial of service (reboot and reset to factory defaults) via a request to cgi-bin/hardfactorydefault. Las cámaras IP TP-Link TL-SC3171, TL-SC3130, TL-SC3130G, TL-SC3171G, y posiblemente otros modelos anteriores al firmeware beta LM.1.6.18P12_sign6, no restringen apropiadamente el acceso a determinadas funciones administrativas, lo cual permite a atacantes remotos (1) causar denegación de servicio (reinicio del dispositivo) a través de una petición cgi-bin/reboot o (2) causar denegación de servicio (reinicio y restauración a valores de fábrica por defecto) a través de una petición cgi-bin/hardfactorydefault. TP-LINK TL-SC3171 IP cameras suffer from an authentication bypass vulnerability. • http://seclists.org/fulldisclosure/2013/Jun/84 http://www.coresecurity.com/advisories/multiple-vulnerabilities-tp-link-tl-sc3171-ip-cameras • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 19%CPEs: 6EXPL: 2CVE-2013-2573 – TP-Link IP Cameras Firmware 1.6.18P12 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-2573
A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless_mft.cgi file in TP-Link IP Cameras TL-SC 3130, TL-SC 3130G, 3171G. and 4171G 1.6.18P12s, which could let a malicious user execute arbitrary code. Se presenta una vulnerabilidad de Inyección de Comandos en el parámetro ap del archivo /cgi-bin/mft/wireless_mft.cgi en TP-Link IP Cameras TL-SC 3130, TL-SC 3130G, 3171G. y 4171G versión 1.6.18P12s, que podría permitir a un usuario malicioso ejecutar código arbitrario. TP-Link IP cameras suffer from hard-coded credential and remote command execution vulnerabilities. • https://www.exploit-db.com/exploits/25812 http://www.securityfocus.com/bid/60195 https://exchange.xforce.ibmcloud.com/vulnerabilities/84574 https://packetstormsecurity.com/files/cve/CVE-2013-2573 https://vuldb.com/?id.8912 https://www.coresecurity.com/advisories/tp-link-IP-cameras-multiple-vulnerabilities • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •