Lucene search

[email protected]CVE-2017-16958

HistoryNov 27, 2017 - 10:29 a.m.

CVE-2017-16958

2017-11-2710:29:00

CWE-78

[email protected]

web.nvd.nist.gov

cve-2017-16958

tp-link

tl-wvr

tl-war

tl-er

tl-r

remote authenticated

arbitrary commands

shell metacharacters

admin/bridge

cgi-bin/luci

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.004 Low

EPSS

Percentile

73.3%

JSON

TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the t_bindif field of an admin/bridge command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/bridge.lua in uhttpd.

Affected configurations

NVD

Node

tp-linktl-wvr300_firmwareMatch-

AND

tp-linktl-wvr300Match-

Node

tp-linktl-wvr302_firmwareMatch-

AND

tp-linktl-wvr302Match-

Node

tp-linktl-wvr450_firmwareMatch-

AND

tp-linktl-wvr450Match-

Node

tp-linktl-wvr450l_firmwareMatch-

AND

tp-linktl-wvr450lMatch-

Node

tp-linktl-wvr450g_firmwareMatch-

AND

tp-linktl-wvr450gMatch-

Node

tp-linktl-wvr458_firmwareMatch-

AND

tp-linktl-wvr458Match-

Node

tp-linktl-wvr458l_firmwareMatch-

AND

tp-linktl-wvr458lMatch-

Node

tp-linktl-wvr458p_firmwareMatch-

AND

tp-linktl-wvr458pMatch-

Node

tp-linktl-wvr900g_firmwareMatch-

AND

tp-linktl-wvr900gMatch-

Node

tp-linktl-wvr900l_firmwareMatch-

AND

tp-linktl-wvr900lMatch-

Node

tp-linktl-wvr1200l_firmwareMatch-

AND

tp-linktl-wvr1200lMatch-

Node

tp-linktl-wvr1300l_firmwareMatch-

AND

tp-linktl-wvr1300lMatch-

Node

tp-linktl-wvr1300g_firmwareMatch-

AND

tp-linktl-war1300gMatch-

Node

tp-linktl-wvr1750l_firmwareMatch-

AND

tp-linktl-wvr1750lMatch-

Node

tp-linktl-war2600l_firmwareMatch-

AND

tp-linktl-wvr2600lMatch-

Node

tp-linktl-wvr4300l_firmwareMatch-

AND

tp-linktl-wvr4300lMatch-

Node

tp-linktl-war302_firmwareMatch-

AND

tp-linktl-war302Match-

Node

tp-linktl-war450_firmwareMatch-

AND

tp-linktl-war450Match-

Node

tp-linktl-war450l_firmwareMatch-

AND

tp-linktl-war450lMatch-

Node

tp-linktl-war458_firmwareMatch-

AND

tp-linktl-war458Match-

Node

tp-linktl-war458l_firmwareMatch-

AND

tp-linktl-war458lMatch-

Node

tp-linktl-war900l_firmwareMatch-

AND

tp-linktl-war900lMatch-

Node

tp-linktl-war1200l_firmwareMatch-

AND

tp-linktl-war1200lMatch-

Node

tp-linktl-war1300l_firmwareMatch-

AND

tp-linktl-war1300lMatch-

Node

tp-linktl-war1750l_firmwareMatch-

AND

tp-linktl-war1750lMatch-

Node

tp-linktl-war2600l_firmwareMatch-

AND

tp-linktl-war2600lMatch-

Node

tp-linktl-er3210g_firmwareMatch-

AND

tp-linktl-er3210gMatch-

Node

tp-linktl-er3220g_firmwareMatch-

AND

tp-linktl-er3220gMatch-

Node

tp-linktl-er5110g_firmwareMatch-

AND

tp-linktl-er5110gMatch-

Node

tp-linktl-er5120g_firmwareMatch-

AND

tp-linktl-er5120gMatch-

Node

tp-linktl-er5510g_firmwareMatch-

AND

tp-linktl-er5510gMatch-

Node

tp-linktl-er5520g_firmwareMatch-

AND

tp-linktl-er5520gMatch-

Node

tp-linktl-er6110g_firmwareMatch-

AND

tp-linktl-er6110gMatch-

Node

tp-linktl-er6120g_firmwareMatch-

AND

tp-linktl-er6120gMatch-

Node

tp-linktl-er6220g_firmwareMatch-

AND

tp-linktl-er6220gMatch-

Node

tp-linktl-er6510g_firmwareMatch-

AND

tp-linktl-er6510gMatch-

Node

tp-linktl-er6520g_firmwareMatch-

AND

tp-linktl-er6520gMatch-

Node

tp-linktl-er7520g_firmwareMatch-

AND

tp-linktl-er7520gMatch-

Node

tp-linktl-r473_firmwareMatch-

AND

tp-linktl-r473Match-

Node

tp-linktl-r473g_firmwareMatch-

AND

tp-linktl-r473gMatch-

Node

tp-linktl-r473p-ac_firmwareMatch-

AND

tp-linktl-r473p-acMatch-

Node

tp-linktl-r479gp-ac_firmwareMatch-

AND

tp-linktl-r473gp-acMatch-

Node

tp-linktl-r478_firmwareMatch-

AND

tp-linktl-r478Match-

Node

tp-linktl-r478\+_firmwareMatch-

AND

tp-linktl-r478\+Match-

Node

tp-linktl-r478g_firmwareMatch-

AND

tp-linktl-r478gMatch-

Node

tp-linktl-r478g\+_firmwareMatch-

AND

tp-linktl-r478g\+Match-

Node

tp-linktl-r479p-ac_firmwareMatch-

AND

tp-linktl-r479p-acMatch-

Node

tp-linktl-r479gp-ac_firmwareMatch-

AND

tp-linktl-r479gp-acMatch-

Node

tp-linktl-r479gpe-ac_firmwareMatch-

AND

tp-linktl-r479gpe-acMatch-

Node

tp-linktl-r483_firmwareMatch-

AND

tp-linktl-r483Match-

Node

tp-linktl-r483g_firmwareMatch-

AND

tp-linktl-r483gMatch-

Node

tp-linktl-r488_firmwareMatch-

AND

tp-linktl-r488Match-

Node

tp-linktl-r4149g_firmwareMatch-

AND

tp-linktl-r4149gMatch-

Node

tp-linktl-r4239g_firmwareMatch-

AND

tp-linktl-r4239gMatch-

Node

tp-linktl-r4299g_firmwareMatch-

AND

tp-linktl-r4299gMatch-

CPENameOperatorVersion
tp-link:tl-wvr300_firmwaretp-link tl-wvr300 firmwareeq-

CPE	Name	Operator	Version
tp-link:tl-wvr300_firmware	tp-link tl-wvr300 firmware	eq	-

References

github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkBridgeAuthenticatedRCE.txt

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.004 Low

EPSS

Percentile

73.3%

JSON

Related for CVE-2017-16958

prion1 cvelist1 nvd1