CVE-2021-4045
CRITICAL EXPLOITED IN THE WILDTP-Link Tapo C200 Firmware < 1.1.15 - Unauthenticated Remote Code Execution
Title source: llmExploitation Summary
CVE-2021-4045 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 8 public exploits from researchers including hacefresko, 0xbinder, DorskFR.
AI-analyzed exploit summary This exploit leverages an unauthenticated RCE vulnerability in TP-Link Tapo C200 cameras by injecting a reverse shell payload via the 'setLanguage' method. It uses a threading model to simultaneously listen for the reverse shell while delivering the payload.
Description
TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root. The exploitation of this vulnerability allows an attacker to take full control of the camera.
Exploits (8)
This exploit leverages an unauthenticated RCE vulnerability in TP-Link Tapo C200 cameras by injecting a reverse shell payload via the 'setLanguage' method. It uses a threading model to simultaneously listen for the reverse shell while delivering the payload.
This repository contains a functional exploit for CVE-2021-4045, a command injection vulnerability in TP-Link Tapo C200 IP cameras. The exploit leverages insufficient input validation in the `setLanguage` method to achieve unauthenticated remote code execution.
This repository contains a functional exploit for CVE-2021-4045, a command injection vulnerability in TP-Link Tapo C200 cameras. The exploit provides two modes: a reverse shell for remote code execution and an RTSP mode to manipulate camera settings.
This repository contains a functional exploit for CVE-2021-4045, a command injection vulnerability in TP-Link Tapo C200 IP cameras. The exploit leverages insufficient input validation in the `setLanguage` method to achieve unauthenticated remote code execution via crafted JSON payloads.
This repository contains a functional PoC exploit for CVE-2021-4045, targeting Tapo C200 cameras. It leverages a command injection vulnerability in the `setLanguage` method to execute arbitrary commands, including setting the date, modifying `/etc/hosts`, and enabling a telnet daemon.
This PoC exploits an unauthenticated RCE vulnerability in TP-LINK Tapo C200 cameras (CVE-2021-4045) by injecting a reverse shell payload via the `setLanguage` method. It uses a threaded netcat listener to catch the shell.
This repository provides a detailed technical writeup on CVE-2021-4045, a command injection vulnerability in TP-Link Tapo C200 cameras. It includes reconnaissance steps, UART access, and exploration of the device's firmware and services.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H