CRITICAL🇵🇱 Wersja polska

CVE-2020-36178

CVSS 9.8v3.1pub. 2021-01-06upd. 2024-11-21

oal_ipt_addBridgeIsolationRules on TP-Link TL-WR840N 6_EU_0.9.1_4.16 devices allows OS command injection because a raw string entered from the web interface (an IP address field) is used directly for a call to the system library function (for iptables). NOTE: oal_ipt_addBridgeIsolationRules is not the only function that calls util_execSystem.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Tp Link Tl Wr840n

    HW
    Tp-Link
    all versions

  • Tp Link Tl Wr840n Firmware

    OS
    Tp-Link
    6_eu_0.9.1_4.16
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2022-25064CRITICAL9.8PL ✓same product

RCE w TP-LINK TL-WR840N poprzez funkcję oal_wan6_setIpAddr

CVE-2022-25060CRITICAL9.8PL ✓same product

Command injection w routerze TP-LINK TL-WR840N przez komponent oal_startPing

CVE-2022-25061CRITICAL9.8PL ✓same product

Command injection w TP-LINK TL-WR840N przez oal_setIp6DefaultRoute

CVE-2021-41653CRITICAL9.8PL ✓same product

RCE w funkcji PING routera TP-Link TL-WR840N przez pole adresu IP

CVE-2018-11714CRITICAL9.8PL ✓same product

TP-Link TL-WR840N/TL-WR841N — pominięcie uwierzytelnienia poprzez fałszywy nagłówek Referer