CVE-2017-16959

The locale feature in cgi-bin/luci on TP-Link devices (specifically TL-WVR , TL-WAR , TL-ER , and TL-R ) is vulnerable to an information disclosure flaw. A remote authenticated user can test for the existence of arbitrary files by sending an operation=write;locale=%0d request, followed by an oper...