CVE-2018-11481 | BDVDB-2026-101304 Detail

Description#

TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices allow authenticated remote code execution via crafted JSON data because /usr/lib/lua/luci/torchlight/validator.lua does not block various punctuation characters.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/yough3rt/IOT-pwn-for-fun/blob/master/TP-LINK-websys-Authenticated-RCE

Exploit#

No public exploit known

History#

Version 12018-05-30Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.