Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2020-24297: httpd on TP-Link TL-WPA4220 devices (versions 2 through 4) allows remote authenticated users to execute arbitrary OS commands by sending crafted POST requests to the endpoint /admin/powerline. Fixe...

CVE-2020-24297 · published 5 years ago

Summary

httpd on TP-Link TL-WPA4220 devices (versions 2 through 4) allows remote authenticated users to execute arbitrary OS commands by sending crafted POST requests to the endpoint /admin/powerline. Fixed version: TL-WPA4220(EU)_V4_201023

What to do

Update tp-link tl-wpa4220_firmware to version tl-wpa4220\(eu\)_v4_201023 or later.

Affected software

Vendor	Product	Affected versions
tp-link	tl-wpa4220_firmware	< tl-wpa4220\(eu\)_v4_201023 `cpe:2.3:o:tp-link:tl-wpa4220_firmware::::::::`

Original advisory text

References

https://the-hyperbolic.com/posts/vulnerabilities-in-tlwpa4220/ Exploit Third Party Advisory
https://www.tp-link.com/us/support/download/ Product Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.8 High

Exploitation

4% chance of attack within 30 days

Type

CWE-78OS Command Injection

Timeline

Published18 Nov 2020

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2020-24297 · NVD

Track software like this

Free during beta