Vulnerabilities > TP Link
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-01-11 | CVE-2017-15617 | Unspecified vulnerability in Tp-Link products TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the iface variable in the interface_wan.lua file. | 9.0 |
| 2018-01-11 | CVE-2017-15616 | Unspecified vulnerability in Tp-Link products TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-interface variable in the phddns.lua file. | 9.0 |
| 2018-01-11 | CVE-2017-15615 | Unspecified vulnerability in Tp-Link products TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the lcpechointerval variable in the pptp_client.lua file. | 9.0 |
| 2018-01-11 | CVE-2017-15614 | Unspecified vulnerability in Tp-Link products TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-outif variable in the pptp_client.lua file. | 9.0 |
| 2018-01-11 | CVE-2017-15613 | Unspecified vulnerability in Tp-Link products TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-interface variable in the cmxddns.lua file. | 9.0 |
| 2017-12-20 | CVE-2017-17747 | Missing Authentication for Critical Function vulnerability in Tp-Link Tl-Sg108E Firmware 1.0.0 Weak access controls in the Device Logout functionality on the TP-Link TL-SG108E v1.0.0 allow remote attackers to call the logout functionality, triggering a denial of service condition. | 2.7 |
| 2017-12-20 | CVE-2017-17746 | Missing Authentication for Critical Function vulnerability in Tp-Link Tl-Sg108E Firmware 1.0.0 Weak access control methods on the TP-Link TL-SG108E 1.0.0 allow any user on a NAT network with an authenticated administrator to access the device without entering user credentials. | 7.7 |
| 2017-12-20 | CVE-2017-17745 | Cross-site Scripting vulnerability in Tp-Link Tl-Sg108E Firmware 1.0.0 Cross-site scripting (XSS) vulnerability in system_name_set.cgi in TP-Link TL-SG108E 1.0.0 allows authenticated remote attackers to submit arbitrary java script via the 'sysName' parameter. | 3.5 |
| 2017-12-19 | CVE-2017-17758 | OS Command Injection vulnerability in Tp-Link products TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/dhcps command to cgi-bin/luci, related to the zone_get_iface_bydev function in /usr/lib/lua/luci/controller/admin/dhcps.lua in uhttpd. | 9.0 |
| 2017-12-19 | CVE-2017-17757 | OS Command Injection vulnerability in Tp-Link products TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/wportal command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/wportal.lua in uhttpd. | 9.0 |