high7.2
CVE-2017-15632
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-mppeencryption variabl…
Impact
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-mppeencryption variable in the pptp_server.lua file.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tp-Link | Er5110g Firmware | All versions |
| Tp-Link | Er5120g Firmware | All versions |
| Tp-Link | Er5510g Firmware | All versions |
| Tp-Link | Er5520g Firmware | All versions |
| Tp-Link | R4149g Firmware | All versions |
| Tp-Link | R4239g Firmware | All versions |
| Tp-Link | R4299g Firmware | All versions |
| Tp-Link | R473gp-Ac Firmware | All versions |
| Tp-Link | R473g Firmware | All versions |
| Tp-Link | R473p-Ac Firmware | All versions |
| Tp-Link | R473 Firmware | All versions |
| Tp-Link | R478g\+ Firmware | All versions |
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/archive/1/541655/100/0/threaded
- https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt
- http://www.securityfocus.com/archive/1/541655/100/0/threaded
- https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt