CVE-2018-11481
HIGHTP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, TL-IPC40A-4 <1.0.21 Auth RCE via JSON Injection
Title source: llmDescription
TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices allow authenticated remote code execution via crafted JSON data because /usr/lib/lua/luci/torchlight/validator.lua does not block various punctuation characters.
References (1)
Core 1
Core References
Third Party Advisory x_refsource_misc
https://github.com/yough3rt/IOT-pwn-for-fun/blob/master/TP-LINK-websys-Authenticated-RCE
Scores
CVSS v3
8.8
EPSS
0.0168
EPSS Percentile
82.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-20
Status
published
Products (4)
tp-link/ipc_tl-ipc223\(p\)-6_firmware
< 1.0.21
tp-link/tl-ipc323k-d_firmware
< 1.0.21
tp-link/tl-ipc325\(kp\)_firmware
< 1.0.21
tp-link/tl-ipc40a-4_firmware
< 1.0.21
Published
May 30, 2018
Tracked Since
Feb 18, 2026