Filtered by vendor Tp-link Subscriptions
Total 348 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2017-15622 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2019-10-03 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-mppeencryption variable in the pptp_client.lua file.
CVE-2017-15621 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2019-10-03 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the olmode variable in the interface_wan.lua file.
CVE-2017-15620 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2019-10-03 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-zone variable in the ipmac_import.lua file.
CVE-2017-15619 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2019-10-03 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the pptphellointerval variable in the pptp_client.lua file.
CVE-2017-15618 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2019-10-03 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-enable variable in the pptp_client.lua file.
CVE-2017-15617 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2019-10-03 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the iface variable in the interface_wan.lua file.
CVE-2017-15616 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2019-10-03 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-interface variable in the phddns.lua file.
CVE-2017-15615 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2019-10-03 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the lcpechointerval variable in the pptp_client.lua file.
CVE-2017-15614 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2019-10-03 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-outif variable in the pptp_client.lua file.
CVE-2017-15613 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2019-10-03 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-interface variable in the cmxddns.lua file.
CVE-2019-13268 1 Tp-link 4 Archer C2 V1, Archer C2 V1 Firmware, Archer C3200 V1 and 1 more 2019-09-04 N/A
TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They forward ARP requests, which are sent as broadcast packets, between the host and the guest networks. To use this leakage as a direct covert channel, the sender can trivially issue an ARP request to an arbitrary computer on the network. (In general, some routers restrict ARP forwarding only to requests destined for the network's subnet mask, but these routers did not restrict this traffic in any way. Depending on this factor, one must use either the lower 8 bits of the IP address, or the entire 32 bits, as the data payload.)
CVE-2019-12104 1 Tp-link 2 M7350, M7350 Firmware 2019-08-19 N/A
The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by several post-authentication command injection vulnerabilities.
CVE-2019-12195 1 Tp-link 2 Tl-wr840n, Tl-wr840n Firmware 2019-05-29 N/A
TP-Link TL-WR840N v5 00000005 devices allow XSS via the network name. The attacker must log into the router by breaking the password and going to the admin login page by THC-HYDRA to get the network name. With an XSS payload, the network name changed automatically and the internet connection was disconnected. All the users become disconnected from the internet.
CVE-2016-10719 1 Tp-link 2 Archer Cr700, Archer Cr700 Firmware 2019-05-16 N/A
TP-Link Archer CR-700 1.0.6 devices have an XSS vulnerability that can be introduced into the admin account through a DHCP request, allowing the attacker to steal the cookie information, which contains the base64 encoded username and password.
CVE-2018-15840 1 Tp-link 2 Tl-wr840n, Tl-wr840n Firmware 2019-04-02 N/A
TP-Link TL-WR840N devices allow remote attackers to cause a denial of service (networking outage) via fragmented packets, as demonstrated by an "nmap -f" command.
CVE-2018-13134 1 Tp-link 2 Archer C1200, Archer C1200 Firmware 2019-03-28 N/A
TP-Link Archer C1200 1.13 Build 2018/01/24 rel.52299 EU devices have XSS via the PATH_INFO to the /webpages/data URI.
CVE-2018-18428 1 Tp-link 2 Tl-sc3130, Tl-sc3130 Firmware 2019-01-23 N/A
TP-Link TL-SC3130 1.6.18P12_121101 devices allow unauthenticated RTSP stream access, as demonstrated by a /jpg/image.jpg URI.
CVE-2018-19537 1 Tp-link 2 Archer C5, Archer C5 Firmware 2018-12-28 N/A
TP-Link Archer C5 devices through V2_160201_US allow remote command execution via shell metacharacters on the wan_dyn_hostname line of a configuration file that is encrypted with the 478DA50BF9E3D2CF key and uploaded through the web GUI by using the web admin account. The default password of admin may be used in some cases.
CVE-2018-19528 1 Tp-link 2 Tl-wr886n, Tl-wr886n Firmware 2018-12-19 N/A
TP-Link TL-WR886N 7.0 1.1.0 devices allow remote attackers to cause a denial of service (Tlb Load Exception) via crafted DNS packets to port 53/udp.
CVE-2018-15700 1 Tp-link 2 Tl-wrn841n, Tl-wrn841n Firmware 2018-11-27 N/A
The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to a denial of service when an unauthenticated LAN user sends a crafted HTTP header containing an unexpected Referer field.