5758 matches found
Design/Logic Flaw
The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence of arbitrary files by making an operation=write;locale=%0d request, and then making an operation=read request with a crafted Accept-Language HTTP heade...
Command injection
TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the tbindif field of an admin/interface command to cgi-bin/luci, related to the getdevicebyif function in /usr/lib/lua/luci/controller/admin/interface.lua in...
CVE-2017-16957
TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the iface field of an admin/diagnostic command to cgi-bin/luci, related to the zonegeteffectdevices function in...
CVE-2017-16958
TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the tbindif field of an admin/bridge command to cgi-bin/luci, related to the getdevicebyif function in /usr/lib/lua/luci/controller/admin/bridge.lua in uhttpd...
CVE-2017-16959
The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence of arbitrary files by making an operation=write;locale=%0d request, and then making an operation=read request with a crafted Accept-Language HTTP heade...
CVE-2017-16960
TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the tbindif field of an admin/interface command to cgi-bin/luci, related to the getdevicebyif function in /usr/lib/lua/luci/controller/admin/interface.lua in...
Design/Logic Flaw
TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the tbindif field of an admin/bridge command to cgi-bin/luci, related to the getdevicebyif function in /usr/lib/lua/luci/controller/admin/bridge.lua in uhttpd...
CVE-2017-16957
TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the iface field of an admin/diagnostic command to cgi-bin/luci, related to the zonegeteffectdevices function in...
CVE-2017-16958
TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the tbindif field of an admin/bridge command to cgi-bin/luci, related to the getdevicebyif function in /usr/lib/lua/luci/controller/admin/bridge.lua in uhttpd...
CVE-2017-16960
TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the tbindif field of an admin/interface command to cgi-bin/luci, related to the getdevicebyif function in /usr/lib/lua/luci/controller/admin/interface.lua in...
CVE-2017-16959
The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence of arbitrary files by making an operation=write;locale=%0d request, and then making an operation=read request with a crafted Accept-Language HTTP heade...
CVE-2017-16957
CVE-2017-16957 affects TP-Link TL-WVR, TL-WAR, TL-ER and TL-R devices. A remote authenticated attacker can inject shell metacharacters via the iface field in the admin/diagnostic interface (cgi-bin/luci) that calls zone_get_effect_devices in /usr/lib/lua/luci/controller/admin/diagnostic.lua, trig...
CVE-2017-16960
This entry (CVE-2017-16960) concerns TP-Link devices TL-WVR, TL-WAR, TL-ER, and TL-R where remote authenticated users can execute arbitrary commands via shell metacharacters in the t_bindif parameter sent to cgi-bin/luci, related to get_device_byif in /usr/lib/lua/luci/controller/admin/interface....
CVE-2017-16958
The CVE affects TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices. Affected component is the admin/bridge CGI in uhttpd, where shell metacharacters in the t_bindif field passed via the admin/bridge command to cgi-bin/luci can lead to remote command execution. Root cause is input constructed to trig...
CVE-2017-16959
The locale feature in cgi-bin/luci on TP-Link devices (specifically TL-WVR , TL-WAR , TL-ER , and TL-R ) is vulnerable to an information disclosure flaw. A remote authenticated user can test for the existence of arbitrary files by sending an operation=write;locale=%0d request, followed by an oper...
PT-2017-14663
Name of the Vulnerable Software and Affected Versions TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices affected versions not specified Description The issue allows remote authenticated users to execute arbitrary commands by injecting shell metacharacters in the t bindif field of an admin/interface...
PT-2017-14659
Name of the Vulnerable Software and Affected Versions TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices affected versions not specified Description The issue allows remote authenticated users to execute arbitrary commands by injecting shell metacharacters in the iface field of an admin/diagnostic...
PT-2017-14661
Name of the Vulnerable Software and Affected Versions TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices affected versions not specified Description The locale feature in cgi-bin/luci allows remote authenticated users to test for the existence of arbitrary files. This is achieved by making an...
CVE-2017-16957: Improper Neutralization of Special Elements used in an OS Command
TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the iface field of an admin/diagnostic command to cgi-bin/luci, related to the zonegeteffectdevices function in...
CVE-2017-16959: Improper Limitation of a Pathname to a Restricted Directory
The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence of arbitrary files by making an operation=write;locale=%0d request, and then making an operation=read request with a crafted Accept-Language HTTP heade...