Lucene search

[email protected]CVE-2017-16959

HistoryNov 27, 2017 - 10:29 a.m.

CVE-2017-16959

2017-11-2710:29:00

CWE-22

[email protected]

web.nvd.nist.gov

cve-2017-16959

tp-link

tl-wvr

tl-war

tl-er

tl-r

remote code execution

file testing

nvd

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.3 Medium

AI Score

Confidence

High

0.048 Low

EPSS

Percentile

92.8%

JSON

The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence of arbitrary files by making an operation=write;locale=%0d request, and then making an operation=read request with a crafted Accept-Language HTTP header, related to the set_sysinfo and get_sysinfo functions in /usr/lib/lua/luci/controller/locale.lua in uhttpd.

Affected configurations

NVD

Node

tp-linktl-wvr300_firmwareMatch-

AND

tp-linktl-wvr300Match-

Node

tp-linktl-wvr302_firmwareMatch-

AND

tp-linktl-wvr302Match-

Node

tp-linktl-wvr450_firmwareMatch-

AND

tp-linktl-wvr450Match-

Node

tp-linktl-wvr450l_firmwareMatch-

AND

tp-linktl-wvr450lMatch-

Node

tp-linktl-wvr450g_firmwareMatch-

AND

tp-linktl-wvr450gMatch-

Node

tp-linktl-wvr458_firmwareMatch-

AND

tp-linktl-wvr458Match-

Node

tp-linktl-wvr458l_firmwareMatch-

AND

tp-linktl-wvr458lMatch-

Node

tp-linktl-wvr458p_firmwareMatch-

AND

tp-linktl-wvr458pMatch-

Node

tp-linktl-wvr900g_firmwareMatch-

AND

tp-linktl-wvr900gMatch-

Node

tp-linktl-wvr900l_firmwareMatch-

AND

tp-linktl-wvr900lMatch-

Node

tp-linktl-wvr1200l_firmwareMatch-

AND

tp-linktl-wvr1200lMatch-

Node

tp-linktl-wvr1300l_firmwareMatch-

AND

tp-linktl-wvr1300lMatch-

Node

tp-linktl-wvr1300g_firmwareMatch-

AND

tp-linktl-war1300gMatch-

Node

tp-linktl-wvr1750l_firmwareMatch-

AND

tp-linktl-wvr1750lMatch-

Node

tp-linktl-war2600l_firmwareMatch-

AND

tp-linktl-wvr2600lMatch-

Node

tp-linktl-wvr4300l_firmwareMatch-

AND

tp-linktl-wvr4300lMatch-

Node

tp-linktl-war302_firmwareMatch-

AND

tp-linktl-war302Match-

Node

tp-linktl-war450_firmwareMatch-

AND

tp-linktl-war450Match-

Node

tp-linktl-war450l_firmwareMatch-

AND

tp-linktl-war450lMatch-

Node

tp-linktl-war458_firmwareMatch-

AND

tp-linktl-war458Match-

Node

tp-linktl-war458l_firmwareMatch-

AND

tp-linktl-war458lMatch-

Node

tp-linktl-war900l_firmwareMatch-

AND

tp-linktl-war900lMatch-

Node

tp-linktl-war1200l_firmwareMatch-

AND

tp-linktl-war1200lMatch-

Node

tp-linktl-war1300l_firmwareMatch-

AND

tp-linktl-war1300lMatch-

Node

tp-linktl-war1750l_firmwareMatch-

AND

tp-linktl-war1750lMatch-

Node

tp-linktl-war2600l_firmwareMatch-

AND

tp-linktl-war2600lMatch-

Node

tp-linktl-er3210g_firmwareMatch-

AND

tp-linktl-er3210gMatch-

Node

tp-linktl-er3220g_firmwareMatch-

AND

tp-linktl-er3220gMatch-

Node

tp-linktl-er5110g_firmwareMatch-

AND

tp-linktl-er5110gMatch-

Node

tp-linktl-er5120g_firmwareMatch-

AND

tp-linktl-er5120gMatch-

Node

tp-linktl-er5510g_firmwareMatch-

AND

tp-linktl-er5510gMatch-

Node

tp-linktl-er5520g_firmwareMatch-

AND

tp-linktl-er5520gMatch-

Node

tp-linktl-er6110g_firmwareMatch-

AND

tp-linktl-er6110gMatch-

Node

tp-linktl-er6120g_firmwareMatch-

AND

tp-linktl-er6120gMatch-

Node

tp-linktl-er6220g_firmwareMatch-

AND

tp-linktl-er6220gMatch-

Node

tp-linktl-er6510g_firmwareMatch-

AND

tp-linktl-er6510gMatch-

Node

tp-linktl-er6520g_firmwareMatch-

AND

tp-linktl-er6520gMatch-

Node

tp-linktl-er7520g_firmwareMatch-

AND

tp-linktl-er7520gMatch-

Node

tp-linktl-r473_firmwareMatch-

AND

tp-linktl-r473Match-

Node

tp-linktl-r473g_firmwareMatch-

AND

tp-linktl-r473gMatch-

Node

tp-linktl-r473p-ac_firmwareMatch-

AND

tp-linktl-r473p-acMatch-

Node

tp-linktl-r479gp-ac_firmwareMatch-

AND

tp-linktl-r473gp-acMatch-

Node

tp-linktl-r478_firmwareMatch-

AND

tp-linktl-r478Match-

Node

tp-linktl-r478\+_firmwareMatch-

AND

tp-linktl-r478\+Match-

Node

tp-linktl-r478g_firmwareMatch-

AND

tp-linktl-r478gMatch-

Node

tp-linktl-r478g\+_firmwareMatch-

AND

tp-linktl-r478g\+Match-

Node

tp-linktl-r479p-ac_firmwareMatch-

AND

tp-linktl-r479p-acMatch-

Node

tp-linktl-r479gp-ac_firmwareMatch-

AND

tp-linktl-r479gp-acMatch-

Node

tp-linktl-r479gpe-ac_firmwareMatch-

AND

tp-linktl-r479gpe-acMatch-

Node

tp-linktl-r483_firmwareMatch-

AND

tp-linktl-r483Match-

Node

tp-linktl-r483g_firmwareMatch-

AND

tp-linktl-r483gMatch-

Node

tp-linktl-r488_firmwareMatch-

AND

tp-linktl-r488Match-

Node

tp-linktl-r4149g_firmwareMatch-

AND

tp-linktl-r4149gMatch-

Node

tp-linktl-r4239g_firmwareMatch-

AND

tp-linktl-r4239gMatch-

Node

tp-linktl-r4299g_firmwareMatch-

AND

tp-linktl-r4299gMatch-

CPENameOperatorVersion
tp-link:tl-wvr300_firmwaretp-link tl-wvr300 firmwareeq-

CPE	Name	Operator	Version
tp-link:tl-wvr300_firmware	tp-link tl-wvr300 firmware	eq	-

References

github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkLocalePathDisclosure.txt

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.3 Medium

AI Score

Confidence

High

0.048 Low

EPSS

Percentile

92.8%

JSON

Related for CVE-2017-16959

nvd1 prion1 cvelist1