PT-2017-14661 · Tp Link+1 · Tp-Link Tl-R+3

Tianfeng Guan · Published 2017-11-27 · Updated 2017-12-14 · CVE-2017-16959

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices (affected versions not specified)

Description The locale feature in cgi-bin/luci allows remote authenticated users to test for the existence of arbitrary files. This is achieved by making an operation=write;locale=%0d request, followed by an operation=read request with a crafted Accept-Language HTTP header. The issue is related to the set sysinfo and get sysinfo functions in /usr/lib/lua/luci/controller/locale.lua in uhttpd.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-16959

Affected Products

Tp-Link Tl-Er

Tp-Link Tl-R

Tp-Link Tl-War

Uhttpd

References · 2

• 🔥 https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkLocalePathDisclosure.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-16959 · Security Note