CVE-2019-17147

This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-LINK TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 80 by default. When parsing the Hos...

Unauthorized Access Vulnerability in P&L Wireless Network Cameras

hereinafter referred to as "TP-LINK" is a supplier of network communication equipment. An unauthorized access vulnerability exists in TP-LINK's wireless network cameras. An attacker can bypass account login and obtain sensitive information by connecting to the camera's wifi and turning on the GPS...

TP-Link Archer Router Unauthenticated Access Vulnerability

TP-Link Archer are a wireless router from China's P&L TP-Link. The TP-Link Archer router has an unauthenticated access vulnerability that can be exploited by an attacker to reset the administrator password by constructing a malicious attack script...

TP-Link Routers Give Cyberattackers an Open Door to Business Networks

A firmware vulnerability in TP-Link Archer C5 v4 routers used in enterprise and home environments could allow unauthorized, remote access to the device with administrative privileges. The bug CVE-2017-7405 affects models that run firmware version 3.16.0 0.9.1 v600c.0 Build 180124 Rel.28919n. Firs...

The vulnerability of the traceroute function in TP-Link TL-WR840N router software allows a hacker to execute arbitrary code.

The vulnerability of the traceroute function in TP-Link TL-WR840N router software lies in insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by using a specially crafted payload...

The vulnerability of the syntax analysis function for URI identifiers of HTTP-servers of TP-Link TL-R600VPN microprogramming devices allows a perpetrator to cause a service failure.

The vulnerability of the syntax analysis function for URI identifiers of HTTP-servers of TP-Link TL-R600VPN software-based routers exists due to insufficient verification of input data. Exploiting this vulnerability could allow a malicious actor to cause service failures by sending a specially...

The vulnerability of the implementation of diagnostic functions for ping and tracert in the microprogramming software of TP-Link TL-R600VPN allows a intruder to execute arbitrary code.

The vulnerability of the ping and tracert diagnostic functions in the microprogramming software for TP-Link TL-R600VPN implementations lies in the fact that the operation’s results are stored outside of the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute...

The vulnerability of the NAT Port Mapping Protocol implementation in the TP-Link M7350 router’s microprogramming software arises from the failure to take measures to eliminate special elements used in the operating system commands. This vulnerability allows a perpetrator to execute arbitrary commands.

The vulnerability of the NAT Port Mapping Protocol NAT-PMP implementation of TP-Link’s M7350 router software exists due to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

The vulnerability of the External Port component of the TP-Link M7350 microprogramming system’s route blocker lies in its lack of measures to neutralize special elements used in the operating system commands. This allows a hacker to execute arbitrary commands.

The vulnerability of the External Port component of the TP-Link M7350 microprogramming system controller exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

The vulnerability of the Port Triggering function in TP-Link M7350 microprogramming devices arises from the lack of measures to neutralize special elements used in the operating system’s commands. This allows attackers to execute arbitrary commands.

The vulnerability of the Port Triggering function in TP-Link’s M7350 route switch software exists because measures to neutralize the special elements used in the operating system commands are not taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the “Service Name” parameter in the TP-Link M7350 route blocker software exists because measures to neutralize special elements used in the operating system are not taken. This allows a hacker to execute arbitrary commands.

The vulnerability of the “Service Name” parameter in the TP-Link M7350 route switch software exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2019-18992

OpenWrt 18.06.4 allows XSS via these Name fields to the cgi-bin/luci/admin/network/firewall/rules URI: "Open ports on router" and "New forward rule" and "New Source NAT" this can occur, for example, on a TP-Link Archer C7 device...

CVE-2019-18993

OpenWrt 18.06.4 allows XSS via the "New port forward" Name field to the cgi-bin/luci/admin/network/firewall/forwards URI this can occur, for example, on a TP-Link Archer C7 device...

CVE-2019-18993

OpenWrt 18.06.4 allows XSS via the "New port forward" Name field to the cgi-bin/luci/admin/network/firewall/forwards URI this can occur, for example, on a TP-Link Archer C7 device...

CVE-2019-18992

OpenWrt 18.06.4 allows XSS via these Name fields to the cgi-bin/luci/admin/network/firewall/rules URI: "Open ports on router" and "New forward rule" and "New Source NAT" this can occur, for example, on a TP-Link Archer C7 device...

CVE-2019-18993

OpenWrt 18.06.4 allows XSS via the "New port forward" Name field to the cgi-bin/luci/admin/network/firewall/forwards URI this can occur, for example, on a TP-Link Archer C7 device...

Design/Logic Flaw

OpenWrt 18.06.4 allows XSS via the "New port forward" Name field to the cgi-bin/luci/admin/network/firewall/forwards URI this can occur, for example, on a TP-Link Archer C7 device...

Design/Logic Flaw

OpenWrt 18.06.4 allows XSS via these Name fields to the cgi-bin/luci/admin/network/firewall/rules URI: "Open ports on router" and "New forward rule" and "New Source NAT" this can occur, for example, on a TP-Link Archer C7 device...

CVE-2019-18992

OpenWrt 18.06.4 allows XSS via these Name fields to the cgi-bin/luci/admin/network/firewall/rules URI: "Open ports on router" and "New forward rule" and "New Source NAT" this can occur, for example, on a TP-Link Archer C7 device...

CVE-2019-18992

CVE-2019-18992 is an XSS vulnerability in OpenWrt 18.06.4. It affects the /cgi-bin/luci/admin/network/firewall/rules API, where the Name fields (e.g., “Open ports on router”, “New forward rule”, “New Source NAT”) can be crafted to inject script. The issue is demonstrated on devices such as TP-Lin...