CVE-2020-35576

Опубликовано: 26 янв. 2021

Источник: nvd

CVSS3: 8.8

CVSS2: 9

EPSS Высокий

Описание

A Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 (JP) with firmware versions prior to 201216 allows authenticated users to execute arbitrary code as root via shell metacharacters, a different vulnerability than CVE-2018-12577.

Ссылки

https://jvn.jp/en/vu/JVNVU92444096/
Patch
Third Party Advisory
https://www.tp-link.com/jp/support/download/tl-wr841n/v13/#Firmware
Patch
Vendor Advisory
https://www.tp-link.com/us/security
Vendor Advisory
https://jvn.jp/en/vu/JVNVU92444096/
Patch
Third Party Advisory
https://www.tp-link.com/jp/support/download/tl-wr841n/v13/#Firmware
Patch
Vendor Advisory
https://www.tp-link.com/us/security
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:tp-link:tl-wr841n_firmware:*:*:*:*:*:*:*:*

Версия до 201216 (исключая)

cpe:2.3:h:tp-link:tl-wr841n:v13:*:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.71232

Высокий

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-78

Связанные уязвимости

GHSA-3g69-576q-4hxf