CVE-2017-16958

Published: Nov 27, 2017Modified: May 13, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the t_bindif field of an admin/bridge command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/bridge.lua in uhttpd.

Affected (53)

Products: Tp Link: Tl Wvr300 Firmware, Tl Wvr302 Firmware, Tl Wvr450 Firmware, Tl Wvr450l Firmware, Tl Wvr450g Firmware, Tl Wvr458 Firmware, Tl Wvr458l Firmware, Tl Wvr458p Firmware, Tl Wvr900g Firmware, Tl Wvr900l Firmware, Tl Wvr1200l Firmware, Tl Wvr1300l Firmware, Tl Wvr1300g Firmware, Tl Wvr1750l Firmware, Tl Wvr4300l Firmware, Tl War302 Firmware, Tl War450 Firmware, Tl War450l Firmware, Tl War458 Firmware, Tl War458l Firmware, Tl War900l Firmware, Tl War1200l Firmware, Tl War1300l Firmware, Tl War1750l Firmware, Tl War2600l Firmware, Tl Er3210g Firmware, Tl Er3220g Firmware, Tl Er5110g Firmware, Tl Er5120g Firmware, Tl Er5510g Firmware, Tl Er5520g Firmware, Tl Er6110g Firmware, Tl Er6120g Firmware, Tl Er6220g Firmware, Tl Er6510g Firmware, Tl Er6520g Firmware, Tl Er7520g Firmware, Tl R473 Firmware, Tl R473g Firmware, Tl R473p Ac Firmware, Tl R478+ Firmware, Tl R478g+ Firmware, Tl R479p Ac Firmware, Tl R479gp Ac Firmware, Tl R479gpe Ac Firmware, Tl R483 Firmware, Tl R483g Firmware, Tl R488 Firmware, Tl R4149g Firmware, Tl R4239g Firmware, Tl R4299g Firmware

51 products

Tl R479gp Ac Firmware

Tl R479gpe Ac Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr300 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr300	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr302 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr302	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr450 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr450	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr450l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr450l	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr450g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr450g	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr458 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr458	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr458l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr458l	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr458p Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr458p	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr900g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr900g	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr900l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr900l	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr1200l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr1200l	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr1300l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr1300l	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr1300g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War1300g	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr1750l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr1750l	All versions

Configuration O

1 platform

Running on/with	Platform Versions
Tp Link Tl Wvr2600l	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr4300l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr4300l	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl War302 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War302	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl War450 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War450	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl War450l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War450l	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl War458 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War458	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl War458l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War458l	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl War900l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War900l	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl War1200l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War1200l	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl War1300l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War1300l	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl War1750l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War1750l	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl War2600l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War2600l	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er3210g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er3210g	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er3220g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er3220g	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er5110g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er5110g	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er5120g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er5120g	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er5510g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er5510g	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er5520g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er5520g	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er6110g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er6110g	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er6120g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er6120g	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er6220g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er6220g	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er6510g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er6510g	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er6520g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er6520g	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er7520g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er7520g	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R473 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R473	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R473g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R473g	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R473p Ac Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R473p Ac	All versions

Configuration P

1 platform

Running on/with	Platform Versions
Tp Link Tl R473gp Ac	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R478 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R478	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R478+ Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R478+	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R478g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R478g	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R478g+ Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R478g+	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R479p Ac Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R479p Ac	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R479gp Ac Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R479gp Ac	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R479gpe Ac Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R479gpe Ac	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R483 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R483	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R483g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R483g	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R488 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R488	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R4149g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R4149g	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R4239g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R4239g	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R4299g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R4299g	All versions

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (2)

https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkBridgeAuthenticatedRCE.txt

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkBridgeAuthenticatedRCE.txt

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.