CVE-2017-16959

Published: Nov 27, 2017Modified: May 13, 2026

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence of arbitrary files by making an operation=write;locale=%0d request, and then making an operation=read request with a crafted Accept-Language HTTP header, related to the set_sysinfo and get_sysinfo functions in /usr/lib/lua/luci/controller/locale.lua in uhttpd.

Affected (53)

Products: Tp Link: Tl Wvr300 Firmware, Tl Wvr302 Firmware, Tl Wvr450 Firmware, Tl Wvr450l Firmware, Tl Wvr450g Firmware, Tl Wvr458 Firmware, Tl Wvr458l Firmware, Tl Wvr458p Firmware, Tl Wvr900g Firmware, Tl Wvr900l Firmware, Tl Wvr1200l Firmware, Tl Wvr1300l Firmware, Tl Wvr1300g Firmware, Tl Wvr1750l Firmware, Tl Wvr4300l Firmware, Tl War302 Firmware, Tl War450 Firmware, Tl War450l Firmware, Tl War458 Firmware, Tl War458l Firmware, Tl War900l Firmware, Tl War1200l Firmware, Tl War1300l Firmware, Tl War1750l Firmware, Tl War2600l Firmware, Tl Er3210g Firmware, Tl Er3220g Firmware, Tl Er5110g Firmware, Tl Er5120g Firmware, Tl Er5510g Firmware, Tl Er5520g Firmware, Tl Er6110g Firmware, Tl Er6120g Firmware, Tl Er6220g Firmware, Tl Er6510g Firmware, Tl Er6520g Firmware, Tl Er7520g Firmware, Tl R473 Firmware, Tl R473g Firmware, Tl R473p Ac Firmware, Tl R478+ Firmware, Tl R478g+ Firmware, Tl R479p Ac Firmware, Tl R479gp Ac Firmware, Tl R479gpe Ac Firmware, Tl R483 Firmware, Tl R483g Firmware, Tl R488 Firmware, Tl R4149g Firmware, Tl R4239g Firmware, Tl R4299g Firmware

51 products

Tl R479gp Ac Firmware

Tl R479gpe Ac Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr300 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr300	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr302 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr302	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr450 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr450	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr450l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr450l	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr450g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr450g	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr458 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr458	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr458l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr458l	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr458p Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr458p	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr900g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr900g	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr900l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr900l	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr1200l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr1200l	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr1300l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr1300l	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr1300g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War1300g	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr1750l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr1750l	All versions

Configuration O

1 platform

Running on/with	Platform Versions
Tp Link Tl Wvr2600l	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Wvr4300l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Wvr4300l	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl War302 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War302	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl War450 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War450	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl War450l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War450l	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl War458 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War458	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl War458l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War458l	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl War900l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War900l	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl War1200l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War1200l	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl War1300l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War1300l	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl War1750l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War1750l	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl War2600l Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl War2600l	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er3210g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er3210g	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er3220g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er3220g	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er5110g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er5110g	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er5120g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er5120g	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er5510g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er5510g	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er5520g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er5520g	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er6110g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er6110g	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er6120g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er6120g	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er6220g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er6220g	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er6510g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er6510g	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er6520g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er6520g	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl Er7520g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl Er7520g	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R473 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R473	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R473g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R473g	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R473p Ac Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R473p Ac	All versions

Configuration P

1 platform

Running on/with	Platform Versions
Tp Link Tl R473gp Ac	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R478 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R478	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R478+ Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R478+	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R478g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R478g	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R478g+ Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R478g+	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R479p Ac Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R479p Ac	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R479gp Ac Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R479gp Ac	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R479gpe Ac Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R479gpe Ac	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R483 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R483	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R483g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R483g	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R488 Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R488	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R4149g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R4149g	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R4239g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R4239g	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link Tl R4299g Firmware	All versions

Running on/with	Platform Versions
Tp Link Tl R4299g	All versions

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (2)

https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkLocalePathDisclosure.txt

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkLocalePathDisclosure.txt

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.