CVE-2017-16959

🗓️ 27 Nov 2017 10:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 96 Views🌐 WEB

The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for existence of arbitrary files

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2017-16959	28 Oct 202400:00	–	circl
CNVD	Multiple TP-Link Products Information Disclosure Vulnerability	29 Nov 201700:00	–	cnvd
Cvelist	CVE-2017-16959	27 Nov 201710:00	–	cvelist
EUVD	EUVD-2017-8128	7 Oct 202500:30	–	euvd
NVD	CVE-2017-16959	27 Nov 201710:29	–	nvd
Prion	Design/Logic Flaw	27 Nov 201710:29	–	prion
Positive Technologies	PT-2017-14661	27 Nov 201700:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2017-16959: Improper Limitation of a Pathname to a Restricted Directory	27 Nov 201700:00	–	rapid7
VulnCheck KEV	VulnCheck KEV: CVE-2017-16959	7 Mar 201300:00	–	vulncheck_kev

NVD

Node

AND

tp-link tl-wvr300_firmwareMatch-

tp-link tl-wvr300Match-

Node

AND

tp-link tl-wvr302_firmwareMatch-

tp-link tl-wvr302Match-

Node

AND

tp-link tl-wvr450_firmwareMatch-

tp-link tl-wvr450Match-

Node

AND

tp-link tl-wvr450l_firmwareMatch-

tp-link tl-wvr450lMatch-

Node

AND

tp-link tl-wvr450g_firmwareMatch-

tp-link tl-wvr450gMatch-

Node

AND

tp-link tl-wvr458_firmwareMatch-

tp-link tl-wvr458Match-

Node

AND

tp-link tl-wvr458l_firmwareMatch-

tp-link tl-wvr458lMatch-

Node

AND

tp-link tl-wvr458p_firmwareMatch-

tp-link tl-wvr458pMatch-

Node

AND

tp-link tl-wvr900g_firmwareMatch-

tp-link tl-wvr900gMatch-

Node

AND

tp-link tl-wvr900l_firmwareMatch-

tp-link tl-wvr900lMatch-

Node

AND

tp-link tl-wvr1200l_firmwareMatch-

tp-link tl-wvr1200lMatch-

Node

AND

tp-link tl-wvr1300l_firmwareMatch-

tp-link tl-wvr1300lMatch-

Node

AND

tp-link tl-wvr1300g_firmwareMatch-

tp-link tl-war1300gMatch-

Node

AND

tp-link tl-wvr1750l_firmwareMatch-

tp-link tl-wvr1750lMatch-

Node

AND

tp-link tl-war2600l_firmwareMatch-

tp-link tl-wvr2600lMatch-

Node

AND

tp-link tl-wvr4300l_firmwareMatch-

tp-link tl-wvr4300lMatch-

Node

AND

tp-link tl-war302_firmwareMatch-

tp-link tl-war302Match-

Node

AND

tp-link tl-war450_firmwareMatch-

tp-link tl-war450Match-

Node

AND

tp-link tl-war450l_firmwareMatch-

tp-link tl-war450lMatch-

Node

AND

tp-link tl-war458_firmwareMatch-

tp-link tl-war458Match-

Node

AND

tp-link tl-war458l_firmwareMatch-

tp-link tl-war458lMatch-

Node

AND

tp-link tl-war900l_firmwareMatch-

tp-link tl-war900lMatch-

Node

AND

tp-link tl-war1200l_firmwareMatch-

tp-link tl-war1200lMatch-

Node

AND

tp-link tl-war1300l_firmwareMatch-

tp-link tl-war1300lMatch-

Node

AND

tp-link tl-war1750l_firmwareMatch-

tp-link tl-war1750lMatch-

Node

AND

tp-link tl-war2600l_firmwareMatch-

tp-link tl-war2600lMatch-

Node

AND

tp-link tl-er3210g_firmwareMatch-

tp-link tl-er3210gMatch-

Node

AND

tp-link tl-er3220g_firmwareMatch-

tp-link tl-er3220gMatch-

Node

AND

tp-link tl-er5110g_firmwareMatch-

tp-link tl-er5110gMatch-

Node

AND

tp-link tl-er5120g_firmwareMatch-

tp-link tl-er5120gMatch-

Node

AND

tp-link tl-er5510g_firmwareMatch-

tp-link tl-er5510gMatch-

Node

AND

tp-link tl-er5520g_firmwareMatch-

tp-link tl-er5520gMatch-

Node

AND

tp-link tl-er6110g_firmwareMatch-

tp-link tl-er6110gMatch-

Node

AND

tp-link tl-er6120g_firmwareMatch-

tp-link tl-er6120gMatch-

Node

AND

tp-link tl-er6220g_firmwareMatch-

tp-link tl-er6220gMatch-

Node

AND

tp-link tl-er6510g_firmwareMatch-

tp-link tl-er6510gMatch-

Node

AND

tp-link tl-er6520g_firmwareMatch-

tp-link tl-er6520gMatch-

Node

AND

tp-link tl-er7520g_firmwareMatch-

tp-link tl-er7520gMatch-

Node

AND

tp-link tl-r473_firmwareMatch-

tp-link tl-r473Match-

Node

AND

tp-link tl-r473g_firmwareMatch-

tp-link tl-r473gMatch-

Node

AND

tp-link tl-r473p-ac_firmwareMatch-

tp-link tl-r473p-acMatch-

Node

AND

tp-link tl-r479gp-ac_firmwareMatch-

tp-link tl-r473gp-acMatch-

Node

AND

tp-link tl-r478_firmwareMatch-

tp-link tl-r478Match-

Node

AND

tp-link tl-r478+_firmwareMatch-

tp-link tl-r478+Match-

Node

AND

tp-link tl-r478g_firmwareMatch-

tp-link tl-r478gMatch-

Node

AND

tp-link tl-r478g+_firmwareMatch-

tp-link tl-r478g+Match-

Node

AND

tp-link tl-r479p-ac_firmwareMatch-

tp-link tl-r479p-acMatch-

Node

AND

tp-link tl-r479gp-ac_firmwareMatch-

tp-link tl-r479gp-acMatch-

Node

AND

tp-link tl-r479gpe-ac_firmwareMatch-

tp-link tl-r479gpe-acMatch-

Node

AND

tp-link tl-r483_firmwareMatch-

tp-link tl-r483Match-

Node

AND

tp-link tl-r483g_firmwareMatch-

tp-link tl-r483gMatch-

Node

AND

tp-link tl-r488_firmwareMatch-

tp-link tl-r488Match-

Node

AND

tp-link tl-r4149g_firmwareMatch-

tp-link tl-r4149gMatch-

Node

AND

tp-link tl-r4239g_firmwareMatch-

tp-link tl-r4239gMatch-

Node

AND

tp-link tl-r4299g_firmwareMatch-

tp-link tl-r4299gMatch-

Source	Link
github	www.github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkLocalePathDisclosure.txt

Parameter	Position	Path	Description	CWE
operation	query param	cgi-bin/luci	Arbitrary file existence test via operation=write;locale=%0d on cgi-bin/luci; followed by operation=read with crafted Accept-Language header	CWE-22
locale	query param	cgi-bin/luci	Arbitrary file existence test via operation=write;locale=%0d on cgi-bin/luci; followed by operation=read with crafted Accept-Language header	CWE-22
Accept-Language	header	cgi-bin/luci	Read operation with crafted Accept-Language header to disclose arbitrary file information via locale.lua in uhttpd	CWE-22

17 Jun 2026 01:10Current

6.9Medium risk

Vulners AI Score6.9

CVSS 24

CVSS 36.5

EPSS0.0191