TP-Link C2 and C20i Security Bypass Vulnerability

The TP-Link C2 and C20i are router devices from China P&L. A security bypass vulnerability exists in the TP-Link C2 and C20i, which can be exploited by remote attackers to submit a special request to bypass security restrictions and perform unauthorized operations...

Malware Hunter Crawls Internet Looking for RAT C2s

A new crawler released today by Shodan designed to find command and control servers has already unearthed 5,800 controllers for more than 10 remote access Trojan RAT families. The crawler, called Malware Hunter, poses as an infected computer beaconing out to an attacker’s server waiting for...

TP-Link C2 and C20i Security Bypass Vulnerability (CNVD-2017-06904)

The TP-LINK C2 and C20i, among others, are wireless router products from China P&L TP-LINK. vsftpd is a server that runs on a UNIX-like operating system. A security bypass vulnerability exists in the TP-Link C2 and C20i, which allows remote attackers to submit a special request to bypass security...

TP-LINK C2 and C20i Arbitrary Code Execution Vulnerability

TP-LINK C2 and C20i etc. are wireless router products from China P&L TP-LINK. A security vulnerability exists in the TP-Link C2 and C20i 'Diagnostic' page, which allows remote attackers to submit a special request to execute arbitrary code...

CVE-2017-8218

vsftpd on TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n has a backdoor admin account with the 1234 password, a backdoor guest account with the guest password, and a backdoor test account with the test password...

CVE-2017-8218

vsftpd on TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n has a backdoor admin account with the 1234 password, a backdoor guest account with the guest password, and a backdoor test account with the test password...

CVE-2017-8220

TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow remote code execution with a single HTTP request by placing shell commands in a "host=" line within HTTP POST data...

Remote code execution

TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow remote code execution with a single HTTP request by placing shell commands in a "host=" line within HTTP POST data...

CVE-2017-8219

TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow DoSing the HTTP server via a crafted Cookie header to the /cgi/ansi URI...

CVE-2017-8219

TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow DoSing the HTTP server via a crafted Cookie header to the /cgi/ansi URI...

CVE-2017-8220

TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow remote code execution with a single HTTP request by placing shell commands in a "host=" line within HTTP POST data...

CVE-2017-8217

TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n have too permissive iptables rules, e.g., SNMP is not blocked on any interface...

CVE-2017-8218

vsftpd on TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n has a backdoor admin account with the 1234 password, a backdoor guest account with the guest password, and a backdoor test account with the test password...

CVE-2017-8217

CVE-2017-8217 affects TP-Link C2 and C20i routers (firmware up to 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n). A security-bypass vulnerability exists in the device IPtables/iptables rules and web management surface that can enable an attacker to perform unauthorized operations by remote requests; ...

CVE-2017-8218

CVE-2017-8218 affects TP-Link C2 and C20i routers running firmware up to 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n, where vsftpd exposes backdoor credentials (admin: 1234, guest: guest, test: test) allowing unauthorized access to FTP and potentially root access via related components. Connected s...

CVE-2017-8220

CVE-2017-8220 affects TP-Link C2 and C20i routers (firmware up to 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n). A vulnerability in the HTTP management/Diagnostics page allows remote code execution by injecting commands in the host= field of a POST request, enabling an attacker (with credentials) to...

CVE-2017-8219

TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow DoSing the HTTP server via a crafted Cookie header to the /cgi/ansi URI...

CVE-2017-8219

CVE-2017-8219 affects TP-Link C2 and C20i routers up to firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n. An authenticated attacker can trigger a DoS of the HTTP server by sending a crafted Cookie header to /cgi/ansi, and, more critically, perform remote code execution that can dump/modify conf...

FIN7 Evolution and the Phishing LNK

FIN7 is a financially-motivated threat group that has been associated with malicious operations dating back to late 2015. FIN7 is referred to by many vendors as “Carbanak Group”, although we do not equate all usage of the CARBANAK backdoor with FIN7. FireEye recently observed a FIN7 spear phishin...

FIN7 Evolution and the Phishing LNK

FIN7 is a financially-motivated threat group that has been associated with malicious operations dating back to late 2015. FIN7 is referred to by many vendors as “Carbanak Group”, although we do not equate all usage of the CARBANAK backdoor with FIN7. FireEye recently observed a FIN7 spear phishin...