Directory traversal

TP-Link Omada Controller Software 3.2.6 allows Directory Traversal for reading arbitrary files via com.tplink.eap.web.portal.PortalController.getAdvertiseFile in /opt/tplink/EAPController/lib/eap-web-3.2.6.jar...

Hardcoded credentials

Certain TP-Link devices have a Hardcoded Encryption Key. This affects NC200 2.1.9 build 200225, N210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 200304, NC250 1.3.0 build 200304, NC260 1.5.2 build 200304, and NC450 1.5.3 build 200304...

CVE-2020-12111

TP-Link NC260 and NC450 web cameras are affected by CVE-2020-12111: a command-injection in the httpSetEncryptKeyRpm handler for /setEncryptKey.fcgi that allows a remote attacker with web access to execute commands as root. Affected versions are NC260 <= 1.5.2 build 200304 and NC450 <= 1.5.3...

CVE-2020-12111

Certain TP-Link devices allow Command Injection. This affects NC260 1.5.2 build 200304 and NC450 1.5.3 build 200304...

CVE-2020-12110

Certain TP-Link devices have a Hardcoded Encryption Key. This affects NC200 2.1.9 build 200225, N210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 200304, NC250 1.3.0 build 200304, NC260 1.5.2 build 200304, and NC450 1.5.3 build 200304...

CVE-2020-12110

TP-Link NCXXX Cloud Cameras (NC200, NC210, NC220, NC230, NC250, NC260, NC450) are affected by a hardcoded encryption key used to encrypt/decrypt config backups. The issue arises in swSystemBackup/swSystemRestoreFile using DES-ECB with modified s-boxes/permutation tables, enabling potential compro...

CVE-2020-12475

The connected sources confirm a concrete vulnerability in TP-Link Omada Controller Software 3.2.6: a directory traversal flaw in com.tp_link.eap.web.portal.PortalController.getAdvertiseFile within /opt/tplink/EAPController/lib/eap-web-3.2.6.jar allows reading arbitrary files. This is a local atta...

CVE-2020-12475

TP-Link Omada Controller Software 3.2.6 allows Directory Traversal for reading arbitrary files via com.tplink.eap.web.portal.PortalController.getAdvertiseFile in /opt/tplink/EAPController/lib/eap-web-3.2.6.jar...

PT-2020-13040 · Tp Link · Nc210 +6

Name of the Vulnerable Software and Affected Versions: TP-Link NC200 version 2.1.9 build 200225 TP-Link NC210 version 1.0.9 build 200304 TP-Link NC220 version 1.3.0 build 200304 TP-Link NC230 version 1.3.0 build 200304 TP-Link NC250 version 1.3.0 build 200304 TP-Link NC260 version 1.5.2 build...

TP-LINK Cloud Cameras NCXXX Hardcoded Encryption Key

Vulnerability title: TP-LINK Cloud Cameras NCXXX Hardcoded Encryption Key Author: Pietro Oliva CVE: CVE-2020-12110 Vendor: TP-LINK Product: NC200, NC210, NC220, NC230, NC250, NC260, NC450 Affected version: NC200 = 2.1.9 build 200225, NC210 = 1.0.9 build 200304, NC220 = 1.3.0 build 200304, NC230 =...

TP-LINK Cloud Cameras NCXXX SetEncryptKey Command Injection

Vulnerability title: TP-LINK Cloud Cameras NCXXX SetEncryptKey Command Injection Author: Pietro Oliva CVE: CVE-2020-12111 Vendor: TP-LINK Product: NC260, NC450 Affected version: NC260 %s/%08X" 0x00491734 lw a1, EncryptKeyparam ; Attacker controlled string 0x00491738 lw a2, -0x7fd4gp 0x0049173c no...

TP-LINK Cloud Cameras NCXXX Bonjour Command Injection

Vulnerability title: TP-LINK Cloud Cameras NCXXX Bonjour Command Injection Author: Pietro Oliva CVE: CVE-2020-12109 Vendor: TP-LINK Product: NC200, NC210, NC220, NC230, NC250, NC260, NC450 Affected version: NC200 = 2.1.9 build 200225, NC210 = 1.0.9 build 200304, NC220 = 1.3.0 build 200304, NC230 ...

TP-Link TL-WA855RE login.json Improper Authentication Privilege Escalation Vulnerability

This vulnerability allows network-adjacent attackers to escalate privileges on affected installations of TP-Link TL-WA855RE Wi-Fi extenders. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within th...

TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution Exploit

This Metasploit module exploits a command injection vulnerability in the tdpServer daemon /usr/bin/tdpServer, running on the router TP-Link Archer A7/C7 AC1750, hardware version 5, MIPS Architecture, firmware version 190726. The vulnerability can only be exploited by an attacker on the LAN side o...

TP-Link Archer A7/C7 - Unauthenticated LAN Remote Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'openssl' class MetasploitModule 'TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution', 'Description' = %q This module exploits a command injection...

TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'openssl' class MetasploitModule 'TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution', 'Description' = %q This module exploits a command injection...

tp-link.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1136055 Security Researcher Broly157 Helped patch 1571 vulnerabilities Received 7 Coordinated Disclosure badges Received 15 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting tp-link.com website and i...

TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution

This module exploits a command injection vulnerability in the tdpServer daemon /usr/bin/tdpServer, running on the router TP-Link Archer A7/C7 AC1750, hardware version 5, MIPS Architecture, firmware version 190726. The vulnerability can only be exploited by an attacker on the LAN side of the route...

TP-Link TL-WR841N Buffer Overflow Vulnerability (CNVD-2020-23185)

The TP-Link TL-WR841N is a wireless router from China P&L TP-Link. A buffer overflow vulnerability exists in the TP-Link TL-WR841N V10 version using firmware version 3.16.9. A remote attacker can exploit this vulnerability to execute arbitrary code with the help of a GET request...

CVE-2020-8423

A buffer overflow in the httpd daemon on TP-Link TL-WR841N V10 firmware version 3.16.9 devices allows an authenticated remote attacker to execute arbitrary code via a GET request to the page for the configuration of the Wi-Fi network...