CVE-2020-36178

oal_ipt_addBridgeIsolationRules on TP-Link TL-WR840N 6_EU_0.9.1_4.16 devices allows OS command injection because a raw string entered from the web interface (an IP address field) is used directly for a call to the system library function (for iptables). NOTE: oal_ipt_addBridgeIsolationRules is not the only function that calls util_execSystem.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2021-01-06

Last modified

2024-08-04

Weaknesses

CWE-78

Affected products

• Tl-wr840n Firmware (Tp-link)

References

• https://github.com/therealunicornsecurity/therealunicornsecurity.github.io/blob/master/_posts/2020-10-11-TPLink.md
• https://therealunicornsecurity.github.io/TPLink/
• https://www.tp-link.com/fr/support/download/tl-wr840n/v6/#Firmware