Vulnerabilities > TP Link > C2 Firmware

DATE CVE VULNERABILITY TITLE RISK
2017-04-25 CVE-2017-8220 OS Command Injection vulnerability in Tp-Link C20I Firmware and C2 Firmware
TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow remote code execution with a single HTTP request by placing shell commands in a "host=" line within HTTP POST data.
network
low complexity
tp-link CWE-78
critical
9.9
2017-04-25 CVE-2017-8219 Improper Input Validation vulnerability in Tp-Link C20I Firmware and C2 Firmware
TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow DoSing the HTTP server via a crafted Cookie header to the /cgi/ansi URI.
network
low complexity
tp-link CWE-20
6.5
2017-04-25 CVE-2017-8218 Insecure Default Initialization of Resource vulnerability in Tp-Link C20I Firmware and C2 Firmware
vsftpd on TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n has a backdoor admin account with the 1234 password, a backdoor guest account with the guest password, and a backdoor test account with the test password.
network
low complexity
tp-link CWE-1188
critical
9.8
2017-04-25 CVE-2017-8217 Missing Authorization vulnerability in Tp-Link C20I Firmware and C2 Firmware
TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n have too permissive iptables rules, e.g., SNMP is not blocked on any interface.
network
low complexity
tp-link CWE-862
5.3