TP-Link
Page 5 of 6 — TP-Link CVEs from a corpus of 550, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-10888 | Critical | 9.8 | 2020-03-25 | This vulnerability allows remote attackers to bypass authentication on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authent… |
CVE-2020-10887 | Critical | 9.8 | 2020-03-25 | This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required… |
CVE-2020-10886 | Critical | 9.8 | 2020-03-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authen… |
CVE-2020-10885 | Critical | 9.8 | 2020-03-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authen… |
CVE-2020-10884 | High | 8.8 | 2020-03-25 | This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers… |
CVE-2020-10883 | High | 7.8 | 2020-03-25 | This vulnerability allows local attackers to escalate privileges on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. An attacke… |
CVE-2020-10882 | High | 8.8 | 2020-03-25 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 route… |
CVE-2020-10881 | Critical | 9.8 | 2020-03-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authen… |
CVE-2020-9375 | High | 7.5 | 2020-03-25 | TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209 allows remote attackers to cause a denial of service via a crafted HTTP Header containing an unexp… |
CVE-2020-9374 | Critical | 9.8 | 2020-02-24 | On TP-Link TL-WR849N 0.9.1 4.16 devices, a remote command execution vulnerability in the diagnostics area can be exploited when an attacker sends specific shel… |
CVE-2019-16893 | High | 7.5 | 2020-02-03 | The Web Management of TP-Link TP-SG105E V4 1.0.0 Build 20181120 devices allows an unauthenticated attacker to reboot the device via a reboot.cgi request. |
CVE-2013-2646 | High | 7.5 | 2020-02-03 | TP-LINK TL-WR1043ND V1_120405 devices contain an unspecified denial of service vulnerability. |
CVE-2013-2573 | Critical | 9.8 | 2020-01-29 | A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless_mft.cgi file in TP-Link IP Cameras TL-SC 3130, TL-SC 3130G, 3171G. an… |
CVE-2013-2572 | High | 7.5 | 2020-01-29 | A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 due to default hard-coded credentials fo… |
CVE-2019-19143 | Medium | 6.1 | 2020-01-27 | TP-LINK TL-WR849N 0.9.1 4.16 devices do not require authentication to replace the firmware via a POST request to the cgi/softup URI. |
CVE-2019-17147 | High | 8.8 | 2020-01-07 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-LINK TL-WR841N routers. Authentication is not required to… |
CVE-2013-4654 | Critical | 9.8 | 2019-11-13 | Symlink Traversal vulnerability in TP-LINK TL-WDR4300 and TL-1043ND.. |
CVE-2013-4848 | High | 8.8 | 2019-10-25 | TP-Link TL-WDR4300 version 3.13.31 has multiple CSRF vulnerabilities. |
CVE-2019-13653 | Critical | 9.8 | 2019-10-24 | TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow triggerPort OS Command Injection (issue 5 of 5). |
CVE-2019-13652 | Critical | 9.8 | 2019-10-24 | TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow serviceName OS Command Injection (issue 4 of 5). |
CVE-2019-13651 | Critical | 9.8 | 2019-10-24 | TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow portMappingProtocol OS Command Injection (issue 3 of 5). |
CVE-2019-13650 | Critical | 9.8 | 2019-10-24 | TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow internalPort OS Command Injection (issue 2 of 5). |
CVE-2019-13649 | Critical | 9.8 | 2019-10-24 | TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow externalPort OS Command Injection (issue 1 of 5). |
CVE-2019-13268 | High | 8.8 | 2019-08-27 | TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the… |
CVE-2019-13267 | High | 8.8 | 2019-08-27 | TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the… |
CVE-2019-13266 | High | 8.8 | 2019-08-27 | TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the… |
CVE-2019-15060 | High | 8.8 | 2019-08-22 | The traceroute function on the TP-Link TL-WR840N v4 router with firmware through 0.9.1 3.16 is vulnerable to remote code execution via a crafted payload in an… |
CVE-2019-12104 | High | 8.8 | 2019-08-14 | The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by several post-authentication command injection vulnerab… |
CVE-2019-12103 | Critical | 9.8 | 2019-08-14 | The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by a pre-authentication command injection vulnerability. |
CVE-2019-13614 | Critical | 9.8 | 2019-07-17 | CMD_SET_CONFIG_COUNTRY in the TP-Link Device Debug protocol in TP-Link Archer C1200 1.0.0 Build 20180502 rel.45702 and earlier is prone to a stack-based buffer… |
CVE-2019-13613 | Critical | 9.8 | 2019-07-17 | CMD_FTEST_CONFIG in the TP-Link Device Debug protocol in TP-Link Wireless Router Archer Router version 1.0.0 Build 20180502 rel.45702 (EU) and earlier is prone… |
CVE-2018-16119 | High | 7.2 | 2019-06-20 | Stack-based buffer overflow in the httpd server of TP-Link WR1043nd (Firmware Version 3) allows remote attackers to execute arbitrary code via a malicious Medi… |
CVE-2019-6972 | High | 7.5 | 2019-06-19 | An issue was discovered on TP-Link TL-WR1043ND V2 devices. The credentials can be easily decoded and cracked by brute-force, WordList, or Rainbow Table attacks… |
CVE-2019-6971 | Critical | 9.8 | 2019-06-19 | An issue was discovered on TP-Link TL-WR1043ND V2 devices. An attacker can send a cookie in an HTTP authentication packet to the router management web interfac… |
CVE-2019-6989 | High | 8.8 | 2019-06-06 | TP-Link TL-WR940N is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the ipAddrDispose function. By sending specially crafte… |
CVE-2019-12195 | Medium | 4.8 | 2019-05-24 | TP-Link TL-WR840N v5 00000005 devices allow XSS via the network name. The attacker must log into the router by breaking the password and going to the admin log… |
CVE-2016-10719 | Medium | 6.1 | 2019-05-15 | TP-Link Archer CR-700 1.0.6 devices have an XSS vulnerability that can be introduced into the admin account through a DHCP request, allowing the attacker to st… |
CVE-2018-18489 | Medium | 4.9 | 2019-04-16 | The ping feature in the Diagnostic functionality on TP-LINK WR840N v2 Firmware 3.16.9 Build 150701 Rel.51516n devices allows remote attackers to cause a denial… |
CVE-2018-15840 | High | 7.5 | 2019-03-29 | TP-Link TL-WR840N devices allow remote attackers to cause a denial of service (networking outage) via fragmented packets, as demonstrated by an "nmap -f" comma… |
CVE-2019-6487 | High | 8.8 | 2019-01-18 | TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, beca… |
CVE-2018-20372 | Medium | 5.4 | 2018-12-23 | TP-Link TD-W8961ND devices allow XSS via the hostname of a DHCP client. |
CVE-2018-3951 | High | 7.2 | 2018-12-01 | An exploitable remote code execution vulnerability exists in the HTTP header-parsing function of the TP-Link TL-R600VPN HTTP Server. A specially crafted HTTP r… |
CVE-2018-3950 | High | 8.8 | 2018-12-01 | An exploitable remote code execution vulnerability exists in the ping and tracert functionality of the TP-Link TL-R600VPN HWv3 FRNv1.3.0 and HWv2 FRNv1.2.3 htt… |
CVE-2018-3949 | High | 7.5 | 2018-12-01 | An exploitable information disclosure vulnerability exists in the HTTP server functionality of the TP-Link TL-R600VPN. A specially crafted URL can cause a dire… |
CVE-2018-3948 | High | 7.5 | 2018-11-30 | An exploitable denial-of-service vulnerability exists in the URI-parsing functionality of the TP-Link TL-R600VPN HTTP server. A specially crafted URL can cause… |
CVE-2018-19537 | High | 7.2 | 2018-11-26 | TP-Link Archer C5 devices through V2_160201_US allow remote command execution via shell metacharacters on the wan_dyn_hostname line of a configuration file tha… |
CVE-2018-19528 | Critical | 9.8 | 2018-11-26 | TP-Link TL-WR886N 7.0 1.1.0 devices allow remote attackers to cause a denial of service (Tlb Load Exception) via crafted DNS packets to port 53/udp. |
CVE-2018-18428 | High | 7.5 | 2018-10-19 | TP-Link TL-SC3130 1.6.18P12_121101 devices allow unauthenticated RTSP stream access, as demonstrated by a /jpg/image.jpg URI. |
CVE-2018-15702 | High | 8.8 | 2018-10-01 | The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to CSRF due to insufficient validation of the referer field. |
CVE-2018-15701 | Medium | 6.5 | 2018-10-01 | The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to a denial of service when an unauthenticated LAN user sends a crafted HTTP header co… |
CVE-2018-15700 | Medium | 6.5 | 2018-10-01 | The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to a denial of service when an unauthenticated LAN user sends a crafted HTTP header co… |
CVE-2018-5393 | Critical | 9.8 | 2018-09-28 | The TP-LINK EAP Controller is TP-LINK's software for remotely controlling wireless access point devices. It utilizes a Java remote method invocation (RMI) serv… |
CVE-2018-17018 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17017 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17016 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17015 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17014 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17013 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17012 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17011 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17010 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17009 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17008 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17007 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17006 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17005 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17004 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-15172 | High | 7.5 | 2018-08-15 | TP-Link WR840N devices have a buffer overflow via a long Authorization HTTP header. |
CVE-2018-14336 | High | 7.5 | 2018-07-19 | TP-Link WR840N devices allow remote attackers to cause a denial of service (connectivity loss) via a series of packets with random MAC addresses. |
CVE-2018-13134 | Medium | 6.1 | 2018-07-04 | TP-Link Archer C1200 1.13 Build 2018/01/24 rel.52299 EU devices have XSS via the PATH_INFO to the /webpages/data URI. |
CVE-2018-12577 | High | 8.8 | 2018-07-02 | The Ping and Traceroute features on TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices allow authenticated blind Command Injecti… |
CVE-2018-12576 | Medium | 4.3 | 2018-07-02 | TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices allow clickjacking. |
CVE-2018-12575 | Critical | 9.8 | 2018-07-02 | On TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 171019 Rel.55346n devices, all actions in the web interface are affected by bypass of authentication… |
CVE-2018-12574 | High | 8.8 | 2018-07-02 | CSRF exists for all actions in the web interface on TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices. |
CVE-2018-12694 | High | 7.5 | 2018-06-23 | TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote attackers to cause a denial of service (reboot) via data/reboot.json. |
CVE-2018-12693 | Medium | 6.5 | 2018-06-23 | Stack-based buffer overflow in TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote authenticated users to cause a denial of service (… |
CVE-2018-12692 | High | 8.8 | 2018-06-23 | TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the… |
CVE-2018-11714 | Critical | 9.8 | 2018-06-04 | An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622… |
CVE-2018-11482 | Critical | 9.8 | 2018-05-30 | /usr/lib/lua/luci/websys.lua on TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices has a hardcoded zMiVw8Kw0oxKXL0 password. |
CVE-2018-11481 | High | 8.8 | 2018-05-30 | TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices allow authenticated remote code execution via crafted JSON data because /usr… |
CVE-2018-10168 | High | 8.8 | 2018-05-03 | TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows do not control privileges for usage of the Web API, allowing a low-privilege u… |
CVE-2018-10167 | High | 7.5 | 2018-05-03 | The web application backup file in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows is encrypted with a hard-coded cryptogr… |
CVE-2018-10166 | High | 8.8 | 2018-05-03 | The web management interface in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows does not have Anti-CSRF tokens in any form… |
CVE-2018-10165 | Medium | 5.4 | 2018-05-03 | Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows allows authenticated at… |
CVE-2018-10164 | Medium | 5.4 | 2018-05-03 | Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows allows authenticated at… |
CVE-2017-15637 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the pptphellointerval variable… |
CVE-2017-15636 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-time variable in the w… |
CVE-2017-15635 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the max_conn variable in the s… |
CVE-2017-15634 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the name variable in the wport… |
CVE-2017-15633 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-ipgroup variable in th… |
CVE-2017-15632 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-mppeencryption variabl… |
CVE-2017-15631 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-workmode variable in t… |
CVE-2017-15630 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-remotesubnet variable… |
CVE-2017-15629 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-tunnelname variable in… |
CVE-2017-15628 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the lcpechointerval variable i… |
CVE-2017-15627 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-pns variable in the pp… |
CVE-2017-15626 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-bindif variable in the… |
CVE-2017-15625 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-olmode variable in the… |
CVE-2017-15624 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-authtype variable in t… |
CVE-2017-15623 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-enable variable in the… |