HIGH🇵🇱 Wersja polska

CVE-2019-6487

CVSS 8.8v3.0pub. 2019-01-18upd. 2024-11-21

TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, because shell metacharacters can be included in the weather get_weather_observe citycode field.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Tp Link Tl Wdr3500

    HW
    Tp-Link
    all versions

  • Tp Link Tl Wdr3500 Firmware

    OS
    Tp-Link
    ≤ 3.0

  • Tp Link Tl Wdr3600

    HW
    Tp-Link
    all versions

  • Tp Link Tl Wdr3600 Firmware

    OS
    Tp-Link
    ≤ 3.0

  • Tp Link Tl Wdr4300

    HW
    Tp-Link
    all versions

  • Tp Link Tl Wdr4300 Firmware

    OS
    Tp-Link
    ≤ 3.0

  • Tp Link Tl Wdr4900

    HW
    Tp-Link
    all versions

  • Tp Link Tl Wdr4900 Firmware

    OS
    Tp-Link
    ≤ 3.0

  • Tp Link Tl Wdr5620

    HW
    Tp-Link
    all versions

  • Tp Link Tl Wdr5620 Firmware

    OS
    Tp-Link
    ≤ 3.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCECommand Injection
CWE
References

Related vulnerabilities

CVE-2013-4654CRITICAL9.8PL ✓same product

Symlink Traversal w firmware routerów TP-LINK TL-WDR4300 i TL-1043ND

CVE-2015-3035HIGH7.5⚠ KEVsame product

Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmwa...

CVE-2024-46486HIGH8.0same product

TP-LINK TL-WDR5620 v2.3 was discovered to contain a remote code execution (RCE) vulnerability via the httpProc...

CVE-2013-4848HIGH8.8same product

TP-Link TL-WDR4300 version 3.13.31 has multiple CSRF vulnerabilities.

CVE-2023-50224MEDIUM6.5⚠ KEVsame product

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability...