CVE-2017-8220

CVE-2017-8220 affects TP-Link C2 and C20i routers (firmware up to 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n). A vulnerability in the HTTP management/Diagnostics page allows remote code execution by injecting commands in the host= field of a POST request, enabling an attacker (with credentials) to...

CVE-2017-8220

TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow remote code execution with a single HTTP request by placing shell commands in a "host=" line within HTTP POST data...

CVE-2017-8217

CVE-2017-8217 affects TP-Link C2 and C20i routers (firmware up to 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n). A security-bypass vulnerability exists in the device IPtables/iptables rules and web management surface that can enable an attacker to perform unauthorized operations by remote requests; ...

CVE-2017-8218

CVE-2017-8218 affects TP-Link C2 and C20i routers running firmware up to 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n, where vsftpd exposes backdoor credentials (admin: 1234, guest: guest, test: test) allowing unauthorized access to FTP and potentially root access via related components. Connected s...

CVE-2017-8217

TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n have too permissive iptables rules, e.g., SNMP is not blocked on any interface...

TP-Link TL-SG108E Security Bypass Vulnerability

The TP-Link TL-SG108E is a Gigabit Ethernet switch. A security vulnerability exists in the TP-Link TL-SG108E. A remote attacker can exploit the vulnerability by submitting a special request for an unauthorized update process...

CVE-2017-8217: Missing Authorization

TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n have too permissive iptables rules, e.g., SNMP is not blocked on any interface...

CVE-2017-8218: Initialization of a Resource with an Insecure Default

vsftpd on TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n has a backdoor admin account with the 1234 password, a backdoor guest account with the guest password, and a backdoor test account with the test password...

CVE-2017-8219: Improper Input Validation

TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow DoSing the HTTP server via a crafted Cookie header to the /cgi/ansi URI...

CVE-2017-8220: Improper Neutralization of Special Elements used in an OS Command

TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow remote code execution with a single HTTP request by placing shell commands in a "host=" line within HTTP POST data...

PT-2017-18222

Name of the Vulnerable Software and Affected Versions TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n Description The issue allows for a denial-of-service DoS attack against the HTTP server by sending a crafted Cookie header to the "/cgi/ansi" API endpoint...

PT-2017-18221

Name of the Vulnerable Software and Affected Versions TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n Description The issue is related to too permissive iptables rules. For example, SNMP is not blocked on any interface, which could pose a security risk...

PT-2017-18223

Name of the Vulnerable Software and Affected Versions TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n Description The issue allows remote code execution with a single HTTP request. This can be achieved by placing shell commands in a host= line within HTTP PO...

TP-Link TL-SG108E Certificate Disclosure Vulnerability

The TP-Link TL-SG108E is a Gigabit Ethernet switch. A security vulnerability exists in the TP-Link TL-SG108E. A remote attacker can exploit the vulnerability to read 'SEND data' logs and retrieve certificates...

TP-Link TL-SG108E 'Switch Info' Certificate Disclosure Vulnerability

The TP-Link TL-SG108E is a Gigabit Ethernet switch. A security vulnerability exists in the TP-Link TL-SG108E. A remote attacker can exploit the vulnerability to read 'Switch Info' logs and retrieve certificates...

TP-Link TL-SG108E Encryption Issue Vulnerability

The TP-Link TL-SG108E is a Gigabit Ethernet switch. A security vulnerability exists in the TP-Link TL-SG108E version 1.0 using firmware version 1.1.2 Build 20141017 Rel.50749, which stems from the program's use of hard-coded encryption keys. An attacker could exploit the vulnerability to obtain...

TP-Link TL-SG108E RC4 Coding Vulnerability

The TP-Link TL-SG108E is a Gigabit Ethernet switch. A security vulnerability exists in the TP-Link TL-SG108E version 1.0 using firmware version 1.1.2 Build 20141017 Rel.50749. An attacker can exploit the vulnerability to obtain information...

CVE-2017-8074

On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "SEND data" log lines where passwords are encoded in hexadecimal. This affects the 1.1.2 Build 20141017 Rel.50749 firmware...

CVE-2017-8076

On the TP-Link TL-SG108E 1.0, admin network communications are RC4 encoded, even though RC4 is deprecated. This affects the 1.1.2 Build 20141017 Rel.50749 firmware...

CVE-2017-8078

On the TP-Link TL-SG108E 1.0, the upgrade process can be requested remotely without authentication httpupg.cgi with a parameter called cmd. This affects the 1.1.2 Build 20141017 Rel.50749 firmware...