CVE-2019-6487

TP-Link WDR Series devices through firmware v3 such as TL-WDR5620 V3.0 are affected by command injection after login leading to remote code execution, because shell metacharacters can be included in the weather getweatherobserve citycode field...

CVE-2019-6487

CVE-2019-6487 affects TP-Link WDR Series devices with firmware v3 (e.g., TL-WDR5620 V3.0). The issue is a command injection vulnerability exploitable after login via the weather get_weather_observe citycode field, enabling remote code execution. Multiple sources (NVD/NVD-derived, Red Hat advisory...