high8.8
CVE-2019-6487
TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, beca…
Impact
TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, because shell metacharacters can be included in the weather get_weather_observe citycode field.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tp-Link | Tl-Wdr5620 Firmware | through 3.0 |
| Tp-Link | Tl-Wdr3500 Firmware | through 3.0 |
| Tp-Link | Tl-Wdr3600 Firmware | through 3.0 |
| Tp-Link | Tl-Wdr4300 Firmware | through 3.0 |
| Tp-Link | Tl-Wdr4900 Firmware | through 3.0 |