Description
TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the t_bindif field of an admin/interface command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/interface.lua in uhttpd.
References (1)
Core 1
Core References
Issue Tracking x_refsource_misc
https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkInterfaceAuthenticatedRCE.txt
Scores
CVSS v3
8.8
EPSS
0.0086
EPSS Percentile
75.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-78
Status
published
Products (50)
tp-link/tl-er3210g_firmware
tp-link/tl-er3220g_firmware
tp-link/tl-er5110g_firmware
tp-link/tl-er5120g_firmware
tp-link/tl-er5510g
v2
tp-link/tl-er5510g
v3
tp-link/tl-er5520g
v2
tp-link/tl-er5520g
v3
tp-link/tl-er6110g_firmware
tp-link/tl-er6120g
v2
... and 40 more
Published
Nov 27, 2017
Tracked Since
Feb 18, 2026