Details of VAR-201805-1239

ID

VAR-201805-1239

TITLE

Command execution vulnerability in TP-Link multiple enterprise routers

Trust: 0.6

sources: CNVD: CNVD-2018-08170

DESCRIPTION

Tplink ER5110G, Tplink ER5120G and Tplink WAR1300L are enterprise VPN routers and enterprise wireless VPN routers of Pulian Technology Co., Ltd. Command execution vulnerability exists in multiple TP-Link enterprise routers. An attacker could use the vulnerability to elevate from administrator privileges to root privileges.

Trust: 0.6

sources: CNVD: CNVD-2018-08170

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2018-08170

AFFECTED PRODUCTS

vendor:	tplink	model:	er5110g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	er5120g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	er5510g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	er5520g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	er6110g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	er6120g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	er6510g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	er6520g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	er7520g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	r4149g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	r4239g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	r4299g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	r473	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	r473g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	r473g-ac	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	r473gp-ac	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	r478g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	r478g	scope:	eq	version:	+	Trust: 0.6
vendor:	tplink	model:	r483	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	r488	scope:	-	version:	-	Trust: 0.6
vendor:	tuplink	model:	war1300l	scope:	-	version:	-	Trust: 0.6
vendor:	tuplink	model:	war1750l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	war2600l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	war302	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	war450	scope:	-	version:	-	Trust: 0.6
vendor:	tuplink	model:	war450l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	war458	scope:	-	version:	-	Trust: 0.6
vendor:	tuplink	model:	war458l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	war900l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr1300l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr1750l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr2600l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr300	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr302	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr4300l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr450	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr450l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr458l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr900g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr900l	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2018-08170

CVSS

SEVERITY

CVSSV2

CVSSV3

CNVD:	CNVD-2018-08170
value:	MEDIUM
Trust: 0.6

CNVD:	CNVD-2018-08170
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:A/AC:H/AU:S/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	HIGH
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	2.5
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

sources: CNVD: CNVD-2018-08170

PATCH

title:

Command execution vulnerability in TP-Link enterprise router

url:

https://www.cnvd.org.cn/patchinfo/show/125493

Trust: 0.6

sources: CNVD: CNVD-2018-08170

EXTERNAL IDS

db:

CNVD

id:

CNVD-2018-08170

Trust: 0.6

sources: CNVD: CNVD-2018-08170

SOURCES

db:

CNVD

id:

CNVD-2018-08170

LAST UPDATE DATE

2022-05-04T09:10:50.966000+00:00

SOURCES UPDATE DATE

db:

CNVD

id:

CNVD-2018-08170

date:

2018-04-24T00:00:00

SOURCES RELEASE DATE

db:

CNVD

id:

CNVD-2018-08170

date:

2018-05-26T00:00:00