CVE-2017-17757

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-12-19T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/wportal command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/wportal.lua in uhttpd."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-12-19T07:57:02.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/L1ZhaoXin/Router-Vulnerability-Research/blob/master/Tplink_LUCI_Wechat_Authenticated_RCE_Record.txt"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-17757", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/wportal command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/wportal.lua in uhttpd."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/L1ZhaoXin/Router-Vulnerability-Research/blob/master/Tplink_LUCI_Wechat_Authenticated_RCE_Record.txt", "refsource": "MISC", "url": "https://github.com/L1ZhaoXin/Router-Vulnerability-Research/blob/master/Tplink_LUCI_Wechat_Authenticated_RCE_Record.txt"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T20:59:17.960Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/L1ZhaoXin/Router-Vulnerability-Research/blob/master/Tplink_LUCI_Wechat_Authenticated_RCE_Record.txt"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-17757", "datePublished": "2017-12-19T07:00:00.000Z", "dateReserved": "2017-12-19T00:00:00.000Z", "dateUpdated": "2024-08-05T20:59:17.960Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-wvr450l_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "DB72835B-95E0-4C65-997C-6FE3656F5584", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-wvr450l:-:*:*:*:*:*:*:*", "matchCriteriaId": "7BFD8A41-3C39-4DB4-B908-ED65AB27BDB7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-wvr458l_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "D1583550-1D76-45E8-89A9-CD1D843BB93E", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-wvr458l:-:*:*:*:*:*:*:*", "matchCriteriaId": "93F85C46-24B2-498E-AB6F-6329EF0F3B84", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-wvr900l_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "F26DA2D7-B242-49D7-A54D-E8F4E8D9E1CD", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-wvr900l:-:*:*:*:*:*:*:*", "matchCriteriaId": "B9C4F2B2-F886-43ED-A29D-20865AA31B55", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-wvr1200l_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "403F67A7-7E54-4255-9838-CDD6B9AA8266", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-wvr1200l:-:*:*:*:*:*:*:*", "matchCriteriaId": "ECE9545C-EC9B-47B0-BEA9-3B2D5109F970", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-wvr1300l_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "E4BFFF84-D7E5-475B-99E6-C93E3844CA4F", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-wvr1300l:-:*:*:*:*:*:*:*", "matchCriteriaId": "1FBBB236-C33A-4FD7-888F-0BA9EB162B9C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-wvr1750l_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "C5A6D7B7-781F-4F3C-B9B8-0C02BD7894F0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-wvr1750l:-:*:*:*:*:*:*:*", "matchCriteriaId": "E7087925-7984-44DD-A20A-8B3C87802E3A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-wvr2600l_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "6FB1C13D-F1B7-40E4-8C70-3DBFBF17671B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-wvr2600l:-:*:*:*:*:*:*:*", "matchCriteriaId": "2896BBB8-BA92-4B36-9BB7-E9397CDBB545", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-wvr4300l_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "14C817C4-0B32-402D-909A-1DC9CA39DA1F", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-wvr4300l:-:*:*:*:*:*:*:*", "matchCriteriaId": "A3E532F4-3E42-4C9F-A01A-E7EFB7B48804", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-war450l_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "FEF8DEA2-F7D4-4ADC-B1F6-78A21CC75181", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-war450l:-:*:*:*:*:*:*:*", "matchCriteriaId": "EF4F2966-FD95-4B94-A7FB-8021782AD170", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-war458l_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "DC78CAB2-0C24-4FF8-B758-AADDB3F24989", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-war458l:-:*:*:*:*:*:*:*", "matchCriteriaId": "5BBD997E-88FC-4D23-B762-331A63A29C83", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-war900l_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "5A4D9E7B-E147-4F80-8CD9-D49B023EEBC0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-war900l:-:*:*:*:*:*:*:*", "matchCriteriaId": "84AB3B41-D8B1-4A0C-A5DD-5254D96D0655", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-war1200l_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "02A26160-2484-4517-B223-40A329DAEDFA", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-war1200l:-:*:*:*:*:*:*:*", "matchCriteriaId": "72F6A8BD-0012-48FA-B5D0-A6F03097FEA7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-war1300l_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "F7B0BCD4-BE7E-4E30-8D41-5BB30EDD1F21", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-war1300l:-:*:*:*:*:*:*:*", "matchCriteriaId": "0D6AE4D9-A750-4770-A07A-FC87DCA4E840", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-war1750l_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "87876AD9-B258-4E8E-ABF6-6704F6EEE468", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-war1750l:-:*:*:*:*:*:*:*", "matchCriteriaId": "E888A70B-984E-4D7C-B324-2F0E9C8E57C6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-war2600l_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "D5CD25BA-4D2F-46FE-B73B-DBFEC70F16CB", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-war2600l:-:*:*:*:*:*:*:*", "matchCriteriaId": "1E4EF035-D38D-478C-BCAA-EE96EBEC9D80", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/wportal command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/wportal.lua in uhttpd."}, {"lang": "es", "value": "Los dispositivos TL-WVR y TL-WAR de TP-Link permiten que usuarios autenticados remotos ejecuten comandos arbitrarios mediante metacaracteres shell en el campo interface de un comando admin/wportal en cgi-bin/luci. Esto se relaciona con la funci\u00f3n get_device_byif en /usr/lib/lua/luci/controller/admin/wportal.lua en uhttpd."}], "id": "CVE-2017-17757", "lastModified": "2026-06-17T01:11:35.663", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-12-19T07:29:00.200", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://github.com/L1ZhaoXin/Router-Vulnerability-Research/blob/master/Tplink_LUCI_Wechat_Authenticated_RCE_Record.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://github.com/L1ZhaoXin/Router-Vulnerability-Research/blob/master/Tplink_LUCI_Wechat_Authenticated_RCE_Record.txt"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}