CVSS: 9.8EPSS: 35%CPEs: 54EXPL: 3CVE-2020-35575 – TP-Link TL-WR841N Command Injection
https://notcve.org/view.php?id=CVE-2020-35575
26 Dec 2020 — A password-disclosure issue in the web interface on certain TP-Link devices allows a remote attacker to get full administrative access to the web panel. This affects WA901ND devices before 3.16.9(201211) beta, and Archer C5, Archer C7, MR3420, MR6400, WA701ND, WA801ND, WDR3500, WDR3600, WE843N, WR1043ND, WR1045ND, WR740N, WR741ND, WR749N, WR802N, WR840N, WR841HP, WR841N, WR842N, WR842ND, WR845N, WR940N, WR941HP, WR945N, WR949N, and WRD4300 devices. Un problema de divulgación de contraseña en la interfaz web... • https://packetstorm.news/files/id/163274 •
CVSS: 8.8EPSS: 25%CPEs: 10EXPL: 2CVE-2019-6487
https://notcve.org/view.php?id=CVE-2019-6487
18 Jan 2019 — TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, because shell metacharacters can be included in the weather get_weather_observe citycode field. Los dispositivos TP-Link WDR Series hasta la versión de firmware v3 (como TL-WDR5620 V3.0) se ven afectados por una inyección de comandos (después de iniciar sesión), conduciendo a la ejecución remota de código debido a que se pueden incluir metacaracteres shel... • https://github.com/afang5472/TP-Link-WDR-Router-Command-injection_POC • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 93%CPEs: 26EXPL: 5CVE-2015-3035 – TP-Link Multiple Archer Devices Directory Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2015-3035
10 Apr 2015 — Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot)... • https://packetstorm.news/files/id/180649 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •