TP-Link
Page 6 of 6 — TP-Link CVEs from a corpus of 550, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-15622 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-mppeencryption variabl… |
CVE-2017-15621 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the olmode variable in the int… |
CVE-2017-15620 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-zone variable in the i… |
CVE-2017-15619 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the pptphellointerval variable… |
CVE-2017-15618 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-enable variable in the… |
CVE-2017-15617 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the iface variable in the inte… |
CVE-2017-15616 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-interface variable in… |
CVE-2017-15615 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the lcpechointerval variable i… |
CVE-2017-15614 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-outif variable in the… |
CVE-2017-15613 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-interface variable in… |
CVE-2017-17747 | Medium | 6.5 | 2017-12-20 | Weak access controls in the Device Logout functionality on the TP-Link TL-SG108E v1.0.0 allow remote attackers to call the logout functionality, triggering a d… |
CVE-2017-17746 | Medium | 6.8 | 2017-12-20 | Weak access control methods on the TP-Link TL-SG108E 1.0.0 allow any user on a NAT network with an authenticated administrator to access the device without ent… |
CVE-2017-17745 | Medium | 5.4 | 2017-12-20 | Cross-site scripting (XSS) vulnerability in system_name_set.cgi in TP-Link TL-SG108E 1.0.0 allows authenticated remote attackers to submit arbitrary java scrip… |
CVE-2017-17758 | High | 8.8 | 2017-12-19 | TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/dh… |
CVE-2017-17757 | High | 8.8 | 2017-12-19 | TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/wp… |
CVE-2017-16960 | High | 8.8 | 2017-11-27 | TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the t_bindif field o… |
CVE-2017-16959 | Medium | 6.5 | 2017-11-27 | The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence of arbitrary… |
CVE-2017-16958 | High | 8.8 | 2017-11-27 | TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the t_bindif field o… |
CVE-2017-16957 | High | 8.8 | 2017-11-27 | TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the iface field of a… |
CVE-2017-13772 | High | 8.8 | 2017-10-23 | Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated users to execute arbitrary code via the… |
CVE-2017-15291 | Medium | 6.1 | 2017-10-20 | Cross-site scripting (XSS) vulnerability in the Wireless MAC Filtering page in TP-LINK TL-MR3220 wireless routers allows remote attackers to inject arbitrary w… |
CVE-2017-11519 | Critical | 9.8 | 2017-07-21 | passwd_recovery.lua on the TP-Link Archer C9(UN)_V2_160517 allows an attacker to reset the admin password by leveraging a predictable random number generator s… |
CVE-2017-10796 | Medium | 6.5 | 2017-07-02 | On TP-Link NC250 devices with firmware through 1.2.1 build 170515, anyone can view video and audio without authentication via an rtsp://admin@yourip:554/h264_h… |
CVE-2017-9466 | Critical | 9.8 | 2017-06-26 | The executable httpd on the TP-Link WR841N V8 router before TL-WR841N(UN)_V8_170210 contained a design flaw in the use of DES for block encryption. This result… |
CVE-2017-8220 | Critical | 9.9 | 2017-04-25 | TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow remote code execution with a single HTTP request by placing shell… |
CVE-2017-8219 | Medium | 6.5 | 2017-04-25 | TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow DoSing the HTTP server via a crafted Cookie header to the /cgi/ans… |
CVE-2017-8218 | Critical | 9.8 | 2017-04-25 | vsftpd on TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n has a backdoor admin account with the 1234 password, a backdoo… |
CVE-2017-8217 | Medium | 5.3 | 2017-04-25 | TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n have too permissive iptables rules, e.g., SNMP is not blocked on any int… |
CVE-2017-8078 | Medium | 5.3 | 2017-04-23 | On the TP-Link TL-SG108E 1.0, the upgrade process can be requested remotely without authentication (httpupg.cgi with a parameter called cmd). This affects the… |
CVE-2017-8077 | High | 7.5 | 2017-04-23 | On the TP-Link TL-SG108E 1.0, there is a hard-coded ciphering key (a long string beginning with Ei2HNryt). This affects the 1.1.2 Build 20141017 Rel.50749 firm… |
CVE-2017-8076 | Critical | 9.8 | 2017-04-23 | On the TP-Link TL-SG108E 1.0, admin network communications are RC4 encoded, even though RC4 is deprecated. This affects the 1.1.2 Build 20141017 Rel.50749 firm… |
CVE-2017-8075 | Critical | 9.8 | 2017-04-23 | On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "Switch Info" log lines where passwords are in cleartext. This affects the 1.1… |
CVE-2017-8074 | Critical | 9.8 | 2017-04-23 | On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "SEND data" log lines where passwords are encoded in hexadecimal. This affects… |
CVE-2016-1000009 | High | 7.5 | 2016-10-06 | TP-LINK lost control of two domains, www.tplinklogin.net and tplinkextender.net. Please note that these domains are physically printed on many of the devices. |
CVE-2015-3035 | High | 7.5 | 2015-04-22 | Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware befo… |
CVE-2014-9510 | | 2015-01-09 | Cross-site request forgery (CSRF) vulnerability in the administration console in TP-Link TL-WR840N (V1) router with firmware before 3.13.27 build 141120 allows… | |
CVE-2014-9350 | | 2014-12-08 | TP-Link TL-WR740N 4 with firmware 3.17.0 Build 140520, 3.16.6 Build 130529, and 3.16.4 Build 130205 allows remote attackers to cause a denial of service (httpd… | |
CVE-2013-2645 | | 2014-10-06 | Multiple cross-site request forgery (CSRF) vulnerabilities on the TP-LINK WR1043N router with firmware TL-WR1043ND_V1_120405 allow remote attackers to hijack t… | |
CVE-2014-4728 | | 2014-09-30 | The web server in the TP-LINK N750 Wireless Dual Band Gigabit Router (TL-WDR4300) with firmware before 140916 allows remote attackers to cause a denial of serv… | |
CVE-2014-4727 | | 2014-09-30 | Cross-site scripting (XSS) vulnerability in the DHCP clients page in the TP-LINK N750 Wireless Dual Band Gigabit Router (TL-WDR4300) with firmware before 14091… | |
CVE-2012-6316 | | 2014-09-30 | Multiple cross-site scripting (XSS) vulnerabilities in the TP-LINK TL-WR841N router with firmware 3.13.9 Build 120201 Rel.54965n and earlier allow remote admin… | |
CVE-2013-6786 | | 2014-01-16 | Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as used on the ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, and D-… | |
CVE-2013-2581 | | 2013-10-11 | cgi-bin/firmwareupgrade in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6 a… | |
CVE-2013-2580 | | 2013-10-11 | Unrestricted file upload vulnerability in cgi-bin/uploadfile in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models befo… | |
CVE-2013-2579 | | 2013-10-11 | TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6 have an empty password for t… | |
CVE-2013-2578 | | 2013-10-11 | cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6 a… | |
CVE-2013-3688 | | 2013-10-01 | The TP-Link IP Cameras TL-SC3171, TL-SC3130, TL-SC3130G, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6, does not properly restr… | |
CVE-2012-6276 | | 2013-01-26 | Directory traversal vulnerability in the web-based management interface on the TP-LINK TL-WR841N router with firmware 3.13.9 build 120201 Rel.54965n and earlie… | |
CVE-2012-5687 | | 2012-11-01 | Directory traversal vulnerability in the web-based management feature on the TP-LINK TL-WR841N router with firmware 3.13.9 build 120201 Rel.54965n and earlier… | |
CVE-2012-2440 | | 2012-04-28 | The default configuration of the TP-Link 8840T router enables web-based administration on the WAN interface, which allows remote attackers to establish an HTTP… |