TP-Link WVR, WAR and ER Device Arbitrary Command Execution Vulnerability (CNVD-2018-02034)

TP-Link WVR, WAR and ER devices are all different series of router products from China P&L TP-LINK. A security vulnerability exists in the TP-Link WVR, WAR, and ER devices. The vulnerability can be exploited by a remote attacker to execute arbitrary commands by injecting commands into the...

Tplink Diagnostic Authenticated RCE

Vulnerability: Command Injection in diagnostic.lua ------------------------------------------ Exploitation: Can remote command execution on the root shell. ------------------------------------------ Vendor of Product: Tp-Link router ------------------------------------------ Affected Products and...

Tplink Bridge Authenticated RCE

Vulnerability: Command Injection in bridge.lua ------------------------------------------ Exploitation: Can remote command execution on the root shell. ------------------------------------------ Vendor of Product: Tp-Link router ------------------------------------------ Affected Products and...

Tplink LocalePath Disclosure

Vulnerability: Path Disclosure in locale.lua ------------------------------------------ Exploitation: Can be used to verify whether a path exists on the file system. ------------------------------------------ Vendor of Product: Tp-Link router ------------------------------------------ Affected...

TP-Link TL-SG108E Denial of Service Vulnerability

The TP-Link TL-SG108E is a Gigabit Ethernet switch from China P&L TP-LINK. A denial of service vulnerability exists in the Device Logout function in the TP-Link TL-SG108E version 1.0.0 due to weak access control. A remote attacker can exploit the vulnerability to invoke the logout function and...

TP-Link TL-SG108E Cross-Site Scripting Vulnerability

The TP-Link TL-SG108E is a Gigabit Ethernet switch from China P&L TP-LINK. A cross-site scripting vulnerability exists in the systemnameset.cgi file in the TP-Link TL-SG108E version 1.0.0. A remote attacker can exploit this vulnerability to submit arbitrary Java script with the help of the...

CVE-2017-17745

Cross-site scripting XSS vulnerability in systemnameset.cgi in TP-Link TL-SG108E 1.0.0 allows authenticated remote attackers to submit arbitrary java script via the 'sysName' parameter...

CVE-2017-17746

Weak access control methods on the TP-Link TL-SG108E 1.0.0 allow any user on a NAT network with an authenticated administrator to access the device without entering user credentials. The authentication record is stored on the device; thus if an administrator authenticates from a NAT network, the...

CVE-2017-17747

Weak access controls in the Device Logout functionality on the TP-Link TL-SG108E v1.0.0 allow remote attackers to call the logout functionality, triggering a denial of service condition...

CVE-2017-17745

Cross-site scripting XSS vulnerability in systemnameset.cgi in TP-Link TL-SG108E 1.0.0 allows authenticated remote attackers to submit arbitrary java script via the 'sysName' parameter...

Race condition

Weak access controls in the Device Logout functionality on the TP-Link TL-SG108E v1.0.0 allow remote attackers to call the logout functionality, triggering a denial of service condition...

CVE-2017-17747

Weak access controls in the Device Logout functionality on the TP-Link TL-SG108E v1.0.0 allow remote attackers to call the logout functionality, triggering a denial of service condition...

Cross site scripting

Cross-site scripting XSS vulnerability in systemnameset.cgi in TP-Link TL-SG108E 1.0.0 allows authenticated remote attackers to submit arbitrary java script via the 'sysName' parameter...

Authentication flaw

Weak access control methods on the TP-Link TL-SG108E 1.0.0 allow any user on a NAT network with an authenticated administrator to access the device without entering user credentials. The authentication record is stored on the device; thus if an administrator authenticates from a NAT network, the...

CVE-2017-17747

Weak access controls in the Device Logout functionality on the TP-Link TL-SG108E v1.0.0 allow remote attackers to call the logout functionality, triggering a denial of service condition...

CVE-2017-17745

Cross-site scripting XSS vulnerability in systemnameset.cgi in TP-Link TL-SG108E 1.0.0 allows authenticated remote attackers to submit arbitrary java script via the 'sysName' parameter...

CVE-2017-17746

Weak access control methods on the TP-Link TL-SG108E 1.0.0 allow any user on a NAT network with an authenticated administrator to access the device without entering user credentials. The authentication record is stored on the device; thus if an administrator authenticates from a NAT network, the...

CVE-2017-17746

TL-SG108E (firmware 1.0.0 Build 20160722 Rel.50167) suffers from CVE-2017-17746, a weak access control flaw where authentication state is stored on the device. This allows any user on a NAT network with an authenticated administrator to access the device without re-entering credentials, since the...

CVE-2017-17747

CVE-2017-17747 affects the TP-Link TL-SG108E, firmware 1.0.0, where the Logout.htm function has weak access control and can be called from any IP address. This allows an attacker to terminate an authenticated session on a target device, potentially triggering a denial-of-service condition and mak...

CVE-2017-17745

Summary of CVE-2017-17745 (TP-Link TL-SG108E) : A cross-site scripting vulnerability exists in the device’s web management interface due to improper input handling in system_name_set.cgi, specifically the sysName parameter. Exploitation requires authentication and allows an attacker to submit arb...