7.2
CVSSv3

CVE-2017-15626

Published: 11/01/2018 Updated: 03/10/2019
CVSS v2 Base Score: 9 | Impact Score: 10 | Exploitability Score: 8
CVSS v3 Base Score: 7.2 | Impact Score: 5.9 | Exploitability Score: 1.2
VMScore: 802
Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C

Vulnerability Summary

TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-bindif variable in the pptp_server.lua file.

Vulnerable Product Search on Vulmon Subscribe to Product

tp-link er5110g firmware -

tp-link er5120g firmware -

tp-link er5510g firmware -

tp-link er5520g firmware -

tp-link r4149g firmware -

tp-link r4239g firmware -

tp-link r4299g firmware -

tp-link r473gp-ac firmware -

tp-link r473g firmware -

tp-link r473p-ac firmware -

tp-link r473 firmware -

tp-link r478g+ firmware -

tp-link r478 firmware -

tp-link r478+ firmware -

tp-link r483g firmware -

tp-link r483 firmware -

tp-link r488 firmware -

tp-link war1300l firmware -

tp-link war1750l firmware -

tp-link war2600l firmware -

tp-link war302 firmware -

tp-link war450l firmware -

tp-link war450 firmware -

tp-link war458l firmware -

tp-link war458 firmware -

tp-link war900l firmware -

tp-link wvr1300g firmware -

tp-link wvr1300l firmware -

tp-link wvr1750l firmware -

tp-link wvr2600l firmware -

tp-link wvr300 firmware -

tp-link wvr302 firmware -

tp-link wvr4300l firmware -

tp-link wvr450l firmware 1.0161125

tp-link wvr450 firmware -

tp-link wvr458l firmware -

tp-link wvr900g firmware 3.0 170306

tp-link wvr900l firmware -

Exploits

Many TP-Link products suffer from multiple authenticated remote command injection vulnerabilities ...