CVE-2017-15626

TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-bindif variable in the pptp_server.lua file.

Score

CVSS 3.0 7.2 High

Status

Modified - cve@mitre.org

Published

2018-01-11

Last modified

2024-08-05

Affected products

• Er5110g Firmware (Tp-link)
• Er5120g Firmware (Tp-link)
• Er5510g Firmware (Tp-link)
• Er5520g Firmware (Tp-link)
• R4149g Firmware (Tp-link)
• R4239g Firmware (Tp-link)
• R4299g Firmware (Tp-link)
• R473 Firmware (Tp-link)
• R473g Firmware (Tp-link)
• R473gp-ac Firmware (Tp-link)
• R473p-ac Firmware (Tp-link)
• R478+ Firmware (Tp-link)
• R478 Firmware (Tp-link)
• R478g+ Firmware (Tp-link)
• R483 Firmware (Tp-link)
• R483g Firmware (Tp-link)
• R488 Firmware (Tp-link)
• War1300l Firmware (Tp-link)
• War1750l Firmware (Tp-link)
• War2600l Firmware (Tp-link)
• War302 Firmware (Tp-link)
• War450 Firmware (Tp-link)
• War450l Firmware (Tp-link)
• War458 Firmware (Tp-link)
• War458l Firmware (Tp-link)
• War900l Firmware (Tp-link)
• Wvr1300g Firmware (Tp-link)
• Wvr1300l Firmware (Tp-link)
• Wvr1750l Firmware (Tp-link)
• Wvr2600l Firmware (Tp-link)
• Wvr300 Firmware (Tp-link)
• Wvr302 Firmware (Tp-link)
• Wvr4300l Firmware (Tp-link)
• Wvr450 Firmware (Tp-link)
• Wvr450l Firmware (Tp-link)
• Wvr458l Firmware (Tp-link)
• Wvr900g Firmware (Tp-link)
• Wvr900l Firmware (Tp-link)

References

• http://www.securityfocus.com/archive/1/541655/100/0/threaded
• https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt