Back to feed
EUVD-2017-8128 · Published Nov 27, 2017
The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence of arbitrary files by making an operation=write;locale=%0d request, and then making an operation=read request with a crafted Accept-Language HTTP header, related to the set_sysinfo and get_sysinfo functions in /usr/lib/lua/luci/controller/locale.lua in uhttpd.
Technologies
Tp-Link Tl-R478\+ FirmwareTp-Link Tl-Wvr450 FirmwareTp-Link Tl-War450 FirmwareTp-Link Tl-Wvr450L FirmwareTp-Link Tl-War1200LTp-Link Tl-R479Gp-Ac FirmwareTp-Link Tl-Er6120GTp-Link Tl-Er3210G FirmwareTp-Link Tl-Wvr900LTp-Link Tl-Er5520GTp-Link Tl-Wvr458LTp-Link Tl-R478\+Tp-Link Tl-Wvr450G FirmwareTp-Link Tl-R488 FirmwareTp-Link Tl-R473Gp-AcTp-Link Tl-R473Tp-Link Tl-Er6220GTp-Link Tl-War2600LTp-Link Tl-R473P-AcTp-Link Tl-War1200L FirmwareTp-Link Tl-Wvr302Tp-Link Tl-War900LTp-Link Tl-R479Gp-AcTp-Link Tl-R4239G FirmwareTp-Link Tl-Wvr302 FirmwareTp-Link Tl-Wvr458P FirmwareTp-Link Tl-R479P-Ac FirmwareTp-Link Tl-Wvr1300LTp-Link Tl-Wvr4300L FirmwareTp-Link Tl-War458LTp-Link Tl-R483Tp-Link Tl-R478 FirmwareTp-Link Tl-R4299G FirmwareTp-Link Tl-Er5110G FirmwareTp-Link Tl-Er6110G FirmwareTp-Link Tl-Wvr458 FirmwareTp-Link Tl-Wvr450GTp-Link Tl-R479P-AcTp-Link Tl-War458 FirmwareTp-Link Tl-Wvr458PTp-Link Tl-R478Tp-Link Tl-R478GTp-Link Tl-Wvr1750L FirmwareTp-Link Tl-Er5520G FirmwareTp-Link Tl-War458Tp-Link Tl-R4149G FirmwareTp-Link Tl-Wvr1750LTp-Link Tl-Wvr450LTp-Link Tl-War900L FirmwareTp-Link Tl-Wvr900L FirmwareTp-Link Tl-Wvr1300G FirmwareTp-Link Tl-R473GTp-Link Tl-Wvr450Tp-Link Tl-War1750L FirmwareTp-Link Tl-R478G\+ FirmwareTp-Link Tl-War450Tp-Link Tl-Er6110GTp-Link Tl-Er5120GTp-Link Tl-War2600L FirmwareTp-Link Tl-Wvr458Tp-Link Tl-Er6510G FirmwareTp-Link Tl-R488Tp-Link Tl-R478G\+Tp-Link Tl-Er6510GTp-Link Tl-Wvr1300L FirmwareTp-Link Tl-R473 FirmwareTp-Link Tl-Wvr2600LTp-Link Tl-Er3220GTp-Link Tl-Er5120G FirmwareTp-Link Tl-R483 FirmwareTp-Link Tl-Er5510GTp-Link Tl-War1300LTp-Link Tl-Wvr458L FirmwareTp-Link Tl-Er7520GTp-Link Tl-War1300GTp-Link Tl-Wvr4300LTp-Link Tl-War302Tp-Link Tl-Er5510G FirmwareTp-Link Tl-Wvr900G FirmwareTp-Link Tl-Wvr1200L FirmwareTp-Link Tl-R479Gpe-Ac FirmwareTp-Link Tl-War458L FirmwareTp-Link Tl-R4239GTp-Link Tl-R483G FirmwareTp-Link Tl-Er3220G FirmwareTp-Link Tl-War450L FirmwareTp-Link Tl-Er5110GTp-Link Tl-Er6120G FirmwareTp-Link Tl-Er3210GTp-Link Tl-R478G FirmwareTp-Link Tl-Er6520GTp-Link Tl-Er7520G FirmwareTp-Link Tl-War302 FirmwareTp-Link Tl-War1750LTp-Link Tl-R473G FirmwareTp-Link Tl-R483GTp-Link Tl-Wvr1200LTp-Link Tl-R473P-Ac FirmwareTp-Link Tl-Er6220G FirmwareTp-Link Tl-War450LTp-Link Tl-Wvr900GTp-Link Tl-Er6520G FirmwareTp-Link Tl-R4299GTp-Link Tl-R4149GTp-Link Tl-Wvr300 FirmwareTp-Link Tl-Wvr300Tp-Link Tl-R479Gpe-AcTp-Link Tl-War1300L Firmware
Weaknesses
CWE-22
CVSS scores
- v3.06.5
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - v2.04.0
AV:N/AC:L/Au:S/C:P/I:N/A:N
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
Potentially impacted assets
See if this affects your attack surface
