CVE-2017-17757

TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/wportal command to cgi-bin/luci, related to the getdevicebyif function in /usr/lib/lua/luci/controller/admin/wportal.lua in uhttpd...

CVE-2017-17757

CVE-2017-17757 affects TP-Link TL-WVR and TL-WAR devices. The vulnerability exists in the uhttpd web interface (admin/wportal) via shell metacharacters in the interface field passed to cgi-bin/luci, related to get_device_byif in /usr/lib/lua/luci/controller/admin/wportal.lua, allowing remote auth...

TP-Link TL-WVR and TL-WAR arbitrary command execution vulnerability (CNVD-2018-01233)

TP-Link TL-WVR and TL-WAR are both wireless router products from China P&L TP-LINK. A security vulnerability exists in the TP-Link TL-WVR and TL-WAR. The vulnerability can be exploited by a remote attacker to execute arbitrary commands by sending the admin/dhcps command with shell metacharacters ...

CVE-2017-16958

The CVE affects TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices. Affected component is the admin/bridge CGI in uhttpd, where shell metacharacters in the t_bindif field passed via the admin/bridge command to cgi-bin/luci can lead to remote command execution. Root cause is input constructed to trig...

CVE-2017-16959

The CVE-2017-16959 vulnerability affects TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices via the locale feature in cgi-bin/luci. The issue arises from set_sysinfo/get_sysinfo in /usr/lib/lua/luci/controller/locale.lua used by uhttpd, allowing remote authenticated users to probe for existence of a...

CVE-2017-16957

CVE-2017-16957 affects TP-Link TL-WVR, TL-WAR, TL-ER and TL-R devices. A remote authenticated attacker can inject shell metacharacters via the iface field in the admin/diagnostic interface (cgi-bin/luci) that calls zone_get_effect_devices in /usr/lib/lua/luci/controller/admin/diagnostic.lua, trig...

VulnCheck KEV: CVE-2017-16959

The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence of arbitrary files by making an operation=write;locale=%0d request, and then making an operation=read request with a crafted Accept-Language HTTP...