CVSS: 9.8EPSS: 13%CPEs: 2EXPL: 4CVE-2020-9374 – TP LINK TL-WR849N - Remote Code Execution
https://notcve.org/view.php?id=CVE-2020-9374
On TP-Link TL-WR849N 0.9.1 4.16 devices, a remote command execution vulnerability in the diagnostics area can be exploited when an attacker sends specific shell metacharacters to the panel's traceroute feature. En los dispositivos TP-Link TL-WR849N versión 0.9.1 4.16, una vulnerabilidad de ejecución de comandos remota en el área de diagnóstico puede ser explotada cuando un atacante envía metacaracteres de shell específicos hacia la funcionalidad traceroute del panel. TP-Link TL-WR849N suffers from a remote code execution vulnerability. • https://www.exploit-db.com/exploits/48155 http://packetstormsecurity.com/files/156584/TP-Link-TL-WR849N-Remote-Code-Execution.html https://fireshellsecurity.team/hack-n-routers https://github.com/ElberTavares/routers-exploit/tree/master/tp-link • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 3CVE-2019-19143 – TL-WR849N 0.9.1 4.16 - Authentication Bypass (Upload Firmware)
https://notcve.org/view.php?id=CVE-2019-19143
TP-LINK TL-WR849N 0.9.1 4.16 devices do not require authentication to replace the firmware via a POST request to the cgi/softup URI. Los dispositivos TP-LINK TL-WR849N versión 0.9.1 4.16, no requieren autenticación para reemplazar el firmware por medio de una petición POST en el URI cgi/softup. TP-Link TL-WR849N version 0.9.1 4.16 suffers from a firmware upload authentication bypass vulnerability. • https://www.exploit-db.com/exploits/48152 http://packetstormsecurity.com/files/156586/TP-Link-TL-WR849N-0.9.1-4.16-Authentication-Bypass.html https://fireshellsecurity.team/hack-n-routers • CWE-306: Missing Authentication for Critical Function •