CVE-2017-16957 | BDVDB-2026-93447 Detail

Description#

TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the iface field of an admin/diagnostic command to cgi-bin/luci, related to the zone_get_effect_devices function in /usr/lib/lua/luci/controller/admin/diagnostic.lua in uhttpd.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.securityfocus.com/bid/101968
https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkDiagnosticAuthenticatedRCE.txt

Exploit#

No public exploit known

History#

Version 12017-11-27Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.