OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| TP-Link Systems Inc. | HB810(US2) V1.0/1.6/2.0/2.6 | unaffected |
|
||||||
| TP-Link Systems Inc. | HB810(EU1) V2.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HB710(US2) V1.6/1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HB710(EU1) 1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HB610(US2) V2.6/2.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HB610(EU1) | unaffected |
|
||||||
| TP-Link Systems Inc. | HB610(CA) V2.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HB410( EU1) 1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HB210(US2) 1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HB210(EU1) 1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HB210 Pro(EU1)1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HB210 Pro(US2)1.0/1.6 | unaffected |
|
||||||
| TP-Link Systems Inc. | EB210 Pro(EU1) 1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EB210 Pro(US1) 1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EB810v(EU1) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX220(BR) V1.0/1.20/1.28/1.29/1.8 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX220(BR) V2.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX220(EU1) V1.0/1.20 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX220(RU) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX220(US1) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX222(EU1) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX222(KR) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX222(US1) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX520v(EU1)1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX820v(EU1) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX920(US2) V1.6/V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | XX530v(BR)v2.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | XX530v(EU1) | unaffected |
|
||||||
| TP-Link Systems Inc. | XX230v(BR) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | VX800v(DE) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | VX420-G2h(AU) V3.0 | unaffected |
|
No data.
No data.
| Vendor | Product | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Tp-link | Eb210 Pro(eu1) 1.0 |
|
||||||||
| Tp-link | Eb210 Pro(us1) 1.0 |
|
||||||||
| Tp-link | Eb810v(eu1) V1.0 |
|
||||||||
| Tp-link | Ex220(br) V1.0/1.20/1.28/1.29/1.8 |
|
||||||||
| Tp-link | Ex220(br) V2.0 |
|
||||||||
| Tp-link | Ex220(eu1) V1.0/1.20 |
|
||||||||
| Tp-link | Ex220(ru) V1.0 |
|
||||||||
| Tp-link | Ex220(us1) V1.0 |
|
||||||||
| Tp-link | Ex222(eu1) V1.0 |
|
||||||||
| Tp-link | Ex222(kr) V1.0 |
|
||||||||
| Tp-link | Ex222(us1) V1.0 |
|
||||||||
| Tp-link | Ex520v(eu1)1.0 |
|
||||||||
| Tp-link | Ex820v(eu1) V1.0 |
|
||||||||
| Tp-link | Ex920(us2) V1.6/v1.0 |
|
||||||||
| Tp-link | Hb210(eu1) 1.0 |
|
||||||||
| Tp-link | Hb210(us2) 1.0 |
|
||||||||
| Tp-link | Hb210 Pro(eu1)1.0 |
|
||||||||
| Tp-link | Hb210 Pro(us2)1.0/1.6 |
|
||||||||
| Tp-link | Hb410( Eu1) 1.0 |
|
||||||||
| Tp-link | Hb610(ca) V2.0 |
|
||||||||
| Tp-link | Hb610(eu1) |
|
||||||||
| Tp-link | Hb610(us2) V2.6/2.0 |
|
||||||||
| Tp-link | Hb710(eu1) 1.0 |
|
||||||||
| Tp-link | Hb710(us2) V1.6/1.0 |
|
||||||||
| Tp-link | Hb810(eu1) V2.0 |
|
||||||||
| Tp-link | Hb810(us2) V1.0/1.6/2.0/2.6 |
|
||||||||
| Tp-link | Vx420-g2h(au) V3.0 |
|
||||||||
| Tp-link | Vx800v(de) V1.0 |
|
||||||||
| Tp-link | Xx230v(br) V1.0 |
|
||||||||
| Tp-link | Xx530v(br)v2.0 |
|
||||||||
| Tp-link | Xx530v(eu1) |
|
No CVSS v3.1
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.409% probability within 30 days)
| Link | Providers |
|---|---|
| https://www.tp-link.com/us/support/faq/5239/ |
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Tp-link
Tp-link eb210 Pro(eu1) 1.0 Tp-link eb210 Pro(us1) 1.0 Tp-link eb810v(eu1) V1.0 Tp-link ex220(br) V1.0/1.20/1.28/1.29/1.8 Tp-link ex220(br) V2.0 Tp-link ex220(eu1) V1.0/1.20 Tp-link ex220(ru) V1.0 Tp-link ex220(us1) V1.0 Tp-link ex222(eu1) V1.0 Tp-link ex222(kr) V1.0 Tp-link ex222(us1) V1.0 Tp-link ex520v(eu1)1.0 Tp-link ex820v(eu1) V1.0 Tp-link ex920(us2) V1.6/v1.0 Tp-link hb210(eu1) 1.0 Tp-link hb210(us2) 1.0 Tp-link hb210 Pro(eu1)1.0 Tp-link hb210 Pro(us2)1.0/1.6 Tp-link hb410( Eu1) 1.0 Tp-link hb610(ca) V2.0 Tp-link hb610(eu1) Tp-link hb610(us2) V2.6/2.0 Tp-link hb710(eu1) 1.0 Tp-link hb710(us2) V1.6/1.0 Tp-link hb810(eu1) V2.0 Tp-link hb810(us2) V1.0/1.6/2.0/2.6 Tp-link vx420-g2h(au) V3.0 Tp-link vx800v(de) V1.0 Tp-link xx230v(br) V1.0 Tp-link xx530v(br)v2.0 Tp-link xx530v(eu1) |
|
| Vendors & Products |
Tp-link
Tp-link eb210 Pro(eu1) 1.0 Tp-link eb210 Pro(us1) 1.0 Tp-link eb810v(eu1) V1.0 Tp-link ex220(br) V1.0/1.20/1.28/1.29/1.8 Tp-link ex220(br) V2.0 Tp-link ex220(eu1) V1.0/1.20 Tp-link ex220(ru) V1.0 Tp-link ex220(us1) V1.0 Tp-link ex222(eu1) V1.0 Tp-link ex222(kr) V1.0 Tp-link ex222(us1) V1.0 Tp-link ex520v(eu1)1.0 Tp-link ex820v(eu1) V1.0 Tp-link ex920(us2) V1.6/v1.0 Tp-link hb210(eu1) 1.0 Tp-link hb210(us2) 1.0 Tp-link hb210 Pro(eu1)1.0 Tp-link hb210 Pro(us2)1.0/1.6 Tp-link hb410( Eu1) 1.0 Tp-link hb610(ca) V2.0 Tp-link hb610(eu1) Tp-link hb610(us2) V2.6/2.0 Tp-link hb710(eu1) 1.0 Tp-link hb710(us2) V1.6/1.0 Tp-link hb810(eu1) V2.0 Tp-link hb810(us2) V1.0/1.6/2.0/2.6 Tp-link vx420-g2h(au) V3.0 Tp-link vx800v(de) V1.0 Tp-link xx230v(br) V1.0 Tp-link xx530v(br)v2.0 Tp-link xx530v(eu1) |
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges. Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise. | |
| Title | OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices | |
| Weaknesses | CWE-78 | |
| References |
| |
| Metrics |
cvssV4_0
|