CVE-2017-16957

high-risk
Published 2017-11-27

TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the iface field of an admin/diagnostic command to cgi-bin/luci, related to the zone_get_effect_devices function in /usr/lib/lua/luci/controller/admin/diagnostic.lua in uhttpd.

Do I need to act?

~
2.9% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (20)

Tl-Wvr302 Firmware
Tl-Wvr450L Firmware
Tl-Wvr458 Firmware
Tl-Wvr458L Firmware
Tl-Wvr900G Firmware
Tl-Wvr900L Firmware
Tl-Wvr1200L Firmware
Tl-Wvr1750L Firmware
Tl-War2600L Firmware
Tl-War302 Firmware
Tl-War450L Firmware
Tl-War458 Firmware
Tl-War458L Firmware
Tl-War900L Firmware
Tl-War1200L Firmware
Tl-War1750L Firmware
Tl-Er3220G Firmware
Tl-Er5110G Firmware
Tl-Er5510G Firmware
Tl-Er6520G Firmware

Affected Vendors

Tp-Link

References (4)

Third Party Advisory http://www.securityfocus.com/bid/101968
Exploit https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkDia...
Third Party Advisory http://www.securityfocus.com/bid/101968
Exploit https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkDia...
62
/ 100
high-risk
Severity 30/34 · Critical
Exploitability 6/34 · Minimal
Exposure 26/34 · High