high8.8
CVE-2017-17758
TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/dh…
Impact
TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/dhcps command to cgi-bin/luci, related to the zone_get_iface_bydev function in /usr/lib/lua/luci/controller/admin/dhcps.lua in uhttpd.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tp-Link | Tl-Wvr450l Firmware | All versions |
| Tp-Link | Tl-Wvr458l Firmware | All versions |
| Tp-Link | Tl-Wvr900l Firmware | All versions |
| Tp-Link | Tl-Wvr1200l Firmware | All versions |
| Tp-Link | Tl-Wvr1300l Firmware | All versions |
| Tp-Link | Tl-Wvr1750l Firmware | All versions |
| Tp-Link | Tl-Wvr2600l Firmware | All versions |
| Tp-Link | Tl-Wvr4300l Firmware | All versions |
| Tp-Link | Tl-War450l Firmware | All versions |
| Tp-Link | Tl-War458l Firmware | All versions |
| Tp-Link | Tl-War900l Firmware | All versions |
| Tp-Link | Tl-War1200l Firmware | All versions |