CVE-2020-12109

TP-Link Cloud Cameras NCXXX series (NC200/NC210/NC220/NC230/NC250/NC260/NC450) are affected by CVE-2020-12109. An authenticated command-injection weakness exists in the NCXXX line, where the system name (used in shell commands) can be leveraged via swBonjourStartHTTP to execute arbitrary commands...

CVE-2020-11445

CVE-2020-11445 affects TP-Link cloud cameras up to 2020-02-09, enabling remote authentication bypass and access to sensitive data via vectors involving a Wi‑Fi session with GPS enabled (CNVD-2020-04855). Connected documents confirm the issue across NVD/Red Hat/PRION records but do not provide spe...

CVE-2020-12110

TP-Link NCXXX Cloud Cameras (NC200, NC210, NC220, NC230, NC250, NC260, NC450) are affected by a hardcoded encryption key used to encrypt/decrypt config backups. The issue arises in swSystemBackup/swSystemRestoreFile using DES-ECB with modified s-boxes/permutation tables, enabling potential compro...

CVE-2020-13224

CVE-2020-13224 affects TP-Link NC-series cloud cameras (NC200, NC210, NC220, NC230, NC250, NC260, NC450). The issue is a buffer/stack overflow in the httpDelMultiUserRpm path used when deleting multiple users via /delmultiuser.fcgi, in the ipcamera binary. The root cause is improper handling of a...

CVE-2020-10231

CVE-2020-10231 affects TP-Link NC200/NC210/NC220/NC230/NC250/NC260/NC450 cameras. The vulnerability resides in the httpLoginRpm path (login.fcgi) of the ipcamera binary: after a successful login, the code does not validate the return value of httpGetEnv(environment, "HTTP_USER_AGENT"), and if the...