CVSS: 7.1EPSS: 0%CPEs: 5EXPL: 2CVE-2013-2580 – TP-Link TL-SC3171 IP Cameras - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-2580
Unrestricted file upload vulnerability in cgi-bin/uploadfile in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6, allows remote attackers to upload arbitrary files, then accessing it via a direct request to the file in the mnt/mtd directory. Vulnerabilidad de subida de ficheros sin restricción en cgi-bin/uploadfile de TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, y posiblemente otros modelos anteriores al firmware en beta LM.1.6.18P12_sign6, permite a atacantes remotos subir archivos arbitrarios, posteriormente acceder a ellos a través de una petición directa al archivo en el directorio mnt/mtd. • https://www.exploit-db.com/exploits/27289 http://www.coresecurity.com/advisories/multiple-vulnerabilities-tp-link-tl-sc3171-ip-cameras •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 2CVE-2013-2581 – TP-Link TL-SC3171 IP Cameras - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-2581
cgi-bin/firmwareupgrade in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6 allows remote attackers to modify the firmware revision via a "preset" action. cgi-bin/firmwareupgrade en cámaras IP TP-Link TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G y posiblemente en otros modelos anteriores al firmware beta LM.1.6.18P12_sign6 permite a atacantes remotos modificar la revisión del firmware a través de una acción "preset". • https://www.exploit-db.com/exploits/27289 http://secunia.com/advisories/54155 http://www.coresecurity.com/advisories/multiple-vulnerabilities-tp-link-tl-sc3171-ip-cameras • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 2%CPEs: 5EXPL: 2CVE-2013-2578 – TP-Link TL-SC3171 IP Cameras - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-2578
cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6 allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the ServerName parameter and (2) other unspecified parameters. cgi-bin/admin/servetest en cámaras IP TP-Link TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G y posiblemente otros modelos anteriores al firmware beta LM.1.6.18P12_sign6 permite a atacantes remotos ejecutar comandos de forma arbitraria a través de metacaracteres shell en (1) el parámetro Servername y (2) otros parámetros no especificados. • https://www.exploit-db.com/exploits/27289 http://www.coresecurity.com/advisories/multiple-vulnerabilities-tp-link-tl-sc3171-ip-cameras • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 2CVE-2013-2579 – TP-Link TL-SC3171 IP Cameras - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-2579
TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6 have an empty password for the hardcoded "qmik" account, which allows remote attackers to obtain administrative access via a TELNET session. Las cámaras IP TP-Link TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, y posiblemente otros modelos anteriores al firmware beta LM.1.6.18P12_sign6 tienen una contraseña vacía para la cuenta incrustada en el código "qmik", lo que permite a atacantes remotos obtener acceso administrativo a través de una sesion TELNET. • https://www.exploit-db.com/exploits/27289 http://www.coresecurity.com/advisories/multiple-vulnerabilities-tp-link-tl-sc3171-ip-cameras • CWE-255: Credentials Management Errors •
CVSS: 7.1EPSS: 0%CPEs: 5EXPL: 1CVE-2013-3688 – TP-LINK TL-SC3171 Authentication Bypass
https://notcve.org/view.php?id=CVE-2013-3688
The TP-Link IP Cameras TL-SC3171, TL-SC3130, TL-SC3130G, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6, does not properly restrict access to certain administrative functions, which allows remote attackers to (1) cause a denial of service (device reboot) via a request to cgi-bin/reboot or (2) cause a denial of service (reboot and reset to factory defaults) via a request to cgi-bin/hardfactorydefault. Las cámaras IP TP-Link TL-SC3171, TL-SC3130, TL-SC3130G, TL-SC3171G, y posiblemente otros modelos anteriores al firmeware beta LM.1.6.18P12_sign6, no restringen apropiadamente el acceso a determinadas funciones administrativas, lo cual permite a atacantes remotos (1) causar denegación de servicio (reinicio del dispositivo) a través de una petición cgi-bin/reboot o (2) causar denegación de servicio (reinicio y restauración a valores de fábrica por defecto) a través de una petición cgi-bin/hardfactorydefault. TP-LINK TL-SC3171 IP cameras suffer from an authentication bypass vulnerability. • http://seclists.org/fulldisclosure/2013/Jun/84 http://www.coresecurity.com/advisories/multiple-vulnerabilities-tp-link-tl-sc3171-ip-cameras • CWE-264: Permissions, Privileges, and Access Controls •