Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-16960: TP-Link TL-ER and TL-R devices let logged-in users run commands

CVE-2017-16960 · published 8 years ago

Summary

Certain TP-Link router models (TL-ER5510G, TL-ER5520G, TL-ER6120G, TL-ER6520G, TL-R4239G) allow a user who has logged in to the web admin interface to inject system commands through a special field. This could let an attacker execute any code on the device, potentially compromising the network. Apply the latest firmware updates from TP-Link and limit admin access to trusted users and strong passwords.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
tp-link	tl-er5510g	v2 v3 `cpe:2.3:h:tp-link:tl-er5510g:v2:::::::*`
tp-link	tl-er5520g	v2 v3 `cpe:2.3:h:tp-link:tl-er5520g:v2:::::::*`
tp-link	tl-er6120g	v2 `cpe:2.3:h:tp-link:tl-er6120g:v2:::::::*`
tp-link	tl-er6520g	v2 v3 `cpe:2.3:h:tp-link:tl-er6520g:v2:::::::*`
tp-link	tl-r4239g	v2 `cpe:2.3:h:tp-link:tl-r4239g:v2:::::::*`
tp-link	tl-r4299g	v2 `cpe:2.3:h:tp-link:tl-r4299g:v2:::::::*`
tp-link	tl-r473	v5 `cpe:2.3:h:tp-link:tl-r473:v5:::::::*`
tp-link	tl-r478	v6 `cpe:2.3:h:tp-link:tl-r478:v6:::::::*`
tp-link	tl-r478\+	v7 `cpe:2.3:h:tp-link:tl-r478\+:v7:::::::*`
tp-link	tl-r478g\+	v3 `cpe:2.3:h:tp-link:tl-r478g\+:v3:::::::*`
tp-link	tl-r483	v5 `cpe:2.3:h:tp-link:tl-r483:v5:::::::*`
tp-link	tl-r483g	v2 `cpe:2.3:h:tp-link:tl-r483g:v2:::::::*`
tp-link	tl-r488	v5 `cpe:2.3:h:tp-link:tl-r488:v5:::::::*`
tp-link	tl-wvr300	v4 `cpe:2.3:h:tp-link:tl-wvr300:v4:::::::*`
tp-link	tl-wvr302	v2 `cpe:2.3:h:tp-link:tl-wvr302:v2:::::::*`
tp-link	tl-wvr450g	v5 `cpe:2.3:h:tp-link:tl-wvr450g:v5:::::::*`
tp-link	tl-wvr900g	v3 `cpe:2.3:h:tp-link:tl-wvr900g:v3:::::::*`
tp-link	tl-wvr450_firmware	All versions `cpe:2.3:o:tp-link:tl-wvr450_firmware:-:::::::*`
tp-link	tl-wvr450l_firmware	All versions `cpe:2.3:o:tp-link:tl-wvr450l_firmware:-:::::::*`
tp-link	tl-wvr458_firmware	All versions `cpe:2.3:o:tp-link:tl-wvr458_firmware:-:::::::*`
tp-link	tl-wvr458l_firmware	All versions `cpe:2.3:o:tp-link:tl-wvr458l_firmware:-:::::::*`
tp-link	tl-wvr458p_firmware	All versions `cpe:2.3:o:tp-link:tl-wvr458p_firmware:-:::::::*`
tp-link	tl-wvr900l_firmware	All versions `cpe:2.3:o:tp-link:tl-wvr900l_firmware:-:::::::*`
tp-link	tl-wvr1200l_firmware	All versions `cpe:2.3:o:tp-link:tl-wvr1200l_firmware:-:::::::*`
tp-link	tl-wvr1300l_firmware	All versions `cpe:2.3:o:tp-link:tl-wvr1300l_firmware:-:::::::*`
tp-link	tl-wvr1300g_firmware	All versions `cpe:2.3:o:tp-link:tl-wvr1300g_firmware:-:::::::*`
tp-link	tl-wvr1750l_firmware	All versions `cpe:2.3:o:tp-link:tl-wvr1750l_firmware:-:::::::*`
tp-link	tl-wvr2600l_firmware	All versions `cpe:2.3:o:tp-link:tl-wvr2600l_firmware:-:::::::*`
tp-link	tl-wvr4300l_firmware	All versions `cpe:2.3:o:tp-link:tl-wvr4300l_firmware:-:::::::*`
tp-link	tl-war302_firmware	All versions `cpe:2.3:o:tp-link:tl-war302_firmware:-:::::::*`
tp-link	tl-war450_firmware	All versions `cpe:2.3:o:tp-link:tl-war450_firmware:-:::::::*`
tp-link	tl-war450l_firmware	All versions `cpe:2.3:o:tp-link:tl-war450l_firmware:-:::::::*`
tp-link	tl-war458_firmware	All versions `cpe:2.3:o:tp-link:tl-war458_firmware:-:::::::*`
tp-link	tl-war458l_firmware	All versions `cpe:2.3:o:tp-link:tl-war458l_firmware:-:::::::*`
tp-link	tl-war900l_firmware	All versions `cpe:2.3:o:tp-link:tl-war900l_firmware:-:::::::*`
tp-link	tl-war1200l_firmware	All versions `cpe:2.3:o:tp-link:tl-war1200l_firmware:-:::::::*`
tp-link	tl-war1300l_firmware	All versions `cpe:2.3:o:tp-link:tl-war1300l_firmware:-:::::::*`
tp-link	tl-war1750l_firmware	All versions `cpe:2.3:o:tp-link:tl-war1750l_firmware:-:::::::*`
tp-link	tl-war2600l_firmware	All versions `cpe:2.3:o:tp-link:tl-war2600l_firmware:-:::::::*`
tp-link	tl-er3210g_firmware	All versions `cpe:2.3:o:tp-link:tl-er3210g_firmware:-:::::::*`
tp-link	tl-er3220g_firmware	All versions `cpe:2.3:o:tp-link:tl-er3220g_firmware::::::::`
tp-link	tl-er5110g_firmware	All versions `cpe:2.3:o:tp-link:tl-er5110g_firmware:-:::::::*`
tp-link	tl-er5120g_firmware	All versions `cpe:2.3:o:tp-link:tl-er5120g_firmware:-:::::::*`
tp-link	tl-er6110g_firmware	All versions `cpe:2.3:o:tp-link:tl-er6110g_firmware:-:::::::*`
tp-link	tl-er6220g_firmware	All versions `cpe:2.3:o:tp-link:tl-er6220g_firmware:-:::::::*`
tp-link	tl-er6510g_firmware	All versions `cpe:2.3:o:tp-link:tl-er6510g_firmware:-:::::::*`
tp-link	tl-er7520g_firmware	All versions `cpe:2.3:o:tp-link:tl-er7520g_firmware:-:::::::*`
tp-link	tl-r473g_firmware	All versions `cpe:2.3:o:tp-link:tl-r473g_firmware:-:::::::*`
tp-link	tl-r473p-ac_firmware	All versions `cpe:2.3:o:tp-link:tl-r473p-ac_firmware:-:::::::*`
tp-link	tl-r473gp-ac_firmware	All versions `cpe:2.3:o:tp-link:tl-r473gp-ac_firmware:-:::::::*`

Showing 50 of 55. Show the rest

Vendor	Product	Affected versions
tp-link	tl-r478g_firmware	All versions `cpe:2.3:o:tp-link:tl-r478g_firmware:-:::::::*`
tp-link	tl-r479p-ac_firmware	All versions `cpe:2.3:o:tp-link:tl-r479p-ac_firmware:-:::::::*`
tp-link	tl-r479gp-ac_firmware	All versions `cpe:2.3:o:tp-link:tl-r479gp-ac_firmware:-:::::::*`
tp-link	tl-r479gpe-ac_firmware	All versions `cpe:2.3:o:tp-link:tl-r479gpe-ac_firmware:-:::::::*`
tp-link	tl-r4149g_firmware	All versions `cpe:2.3:o:tp-link:tl-r4149g_firmware:-:::::::*`

Original advisory text

TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the t_bindif field of an admin/interface command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/interface.lua in uhttpd.

References

https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkInt... Issue Tracking

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.8 High

Exploitation

2% chance of attack within 30 days

Type

CWE-78OS Command Injection

Timeline

Published27 Nov 2017

Updated29 Oct 2026

First seen29 Sep 2026

Sources

CVE-2017-16960 · NVD

Track software like this

Free during beta