PT-2019-18112 · Tp Link · Tp-Link Wdr Series

Fangming Gu + 1 · Published 2019-01-18 · Updated 2020-08-24 · CVE-2019-6487

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TP-Link WDR Series devices through firmware v3

Description The issue affects devices after login, allowing command injection that leads to remote code execution. This is possible because shell metacharacters can be included in the citycode field of the get weather observe function.

Recommendations For TP-Link WDR Series devices through firmware v3, consider restricting access to the get weather observe function until a patch is available, and avoid including shell metacharacters in the citycode field to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-6487

Affected Products

Tp-Link Wdr Series

References · 5

• 🔥 https://github.com/0xcc-Since2016/TP-Link-WDR-Router-Command-injection_POC/blob/master/poc.py · Exploit
• 🔥 https://github.com/afang5472/TP-Link-WDR-Router-Command-injection_POC · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-6487 · Security Note
• https://osv.dev/vulnerability/CVE-2019-6487 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/315 · Telegram Post