mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-28 09:11:28 +00:00
496 lines
13 KiB
JSON
496 lines
13 KiB
JSON
{
|
|
"id": "CVE-2017-17758",
|
|
"sourceIdentifier": "cve@mitre.org",
|
|
"published": "2017-12-19T07:29:00.357",
|
|
"lastModified": "2019-10-03T00:03:26.223",
|
|
"vulnStatus": "Analyzed",
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/dhcps command to cgi-bin/luci, related to the zone_get_iface_bydev function in /usr/lib/lua/luci/controller/admin/dhcps.lua in uhttpd."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "Los dispositivos TL-WVR y TL-WAR de TP-Link permiten que usuarios autenticados remotos ejecuten comandos arbitrarios mediante metacaracteres shell en el campo interface de un comando admin/dhcps en cgi-bin/luci. Esto se relaciona con la funci\u00f3n zone_get_iface_bydev en /usr/lib/lua/luci/controller/admin/dhcps.lua en uhttpd."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV30": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "3.0",
|
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "LOW",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "HIGH",
|
|
"availabilityImpact": "HIGH",
|
|
"baseScore": 8.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"exploitabilityScore": 2.8,
|
|
"impactScore": 5.9
|
|
}
|
|
],
|
|
"cvssMetricV2": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "2.0",
|
|
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
|
|
"accessVector": "NETWORK",
|
|
"accessComplexity": "LOW",
|
|
"authentication": "SINGLE",
|
|
"confidentialityImpact": "COMPLETE",
|
|
"integrityImpact": "COMPLETE",
|
|
"availabilityImpact": "COMPLETE",
|
|
"baseScore": 9.0
|
|
},
|
|
"baseSeverity": "HIGH",
|
|
"exploitabilityScore": 8.0,
|
|
"impactScore": 10.0,
|
|
"acInsufInfo": false,
|
|
"obtainAllPrivilege": false,
|
|
"obtainUserPrivilege": false,
|
|
"obtainOtherPrivilege": false,
|
|
"userInteractionRequired": false
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-78"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"configurations": [
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:tp-link:tl-wvr450l_firmware:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "DB72835B-95E0-4C65-997C-6FE3656F5584"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:tp-link:tl-wvr450l:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "7BFD8A41-3C39-4DB4-B908-ED65AB27BDB7"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:tp-link:tl-wvr458l_firmware:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "D1583550-1D76-45E8-89A9-CD1D843BB93E"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:tp-link:tl-wvr458l:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "93F85C46-24B2-498E-AB6F-6329EF0F3B84"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:tp-link:tl-wvr900l_firmware:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "F26DA2D7-B242-49D7-A54D-E8F4E8D9E1CD"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:tp-link:tl-wvr900l:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "B9C4F2B2-F886-43ED-A29D-20865AA31B55"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:tp-link:tl-wvr1200l_firmware:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "403F67A7-7E54-4255-9838-CDD6B9AA8266"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:tp-link:tl-wvr1200l:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "ECE9545C-EC9B-47B0-BEA9-3B2D5109F970"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:tp-link:tl-wvr1300l_firmware:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "E4BFFF84-D7E5-475B-99E6-C93E3844CA4F"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:tp-link:tl-wvr1300l:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "1FBBB236-C33A-4FD7-888F-0BA9EB162B9C"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:tp-link:tl-wvr1750l_firmware:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "C5A6D7B7-781F-4F3C-B9B8-0C02BD7894F0"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:tp-link:tl-wvr1750l:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "E7087925-7984-44DD-A20A-8B3C87802E3A"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:tp-link:tl-wvr2600l_firmware:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "6FB1C13D-F1B7-40E4-8C70-3DBFBF17671B"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:tp-link:tl-wvr2600l:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "2896BBB8-BA92-4B36-9BB7-E9397CDBB545"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:tp-link:tl-wvr4300l_firmware:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "14C817C4-0B32-402D-909A-1DC9CA39DA1F"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:tp-link:tl-wvr4300l:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "A3E532F4-3E42-4C9F-A01A-E7EFB7B48804"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:tp-link:tl-war450l_firmware:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "FEF8DEA2-F7D4-4ADC-B1F6-78A21CC75181"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:tp-link:tl-war450l:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "EF4F2966-FD95-4B94-A7FB-8021782AD170"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:tp-link:tl-war458l_firmware:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "DC78CAB2-0C24-4FF8-B758-AADDB3F24989"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:tp-link:tl-war458l:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "5BBD997E-88FC-4D23-B762-331A63A29C83"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:tp-link:tl-war900l_firmware:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "5A4D9E7B-E147-4F80-8CD9-D49B023EEBC0"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:tp-link:tl-war900l:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "84AB3B41-D8B1-4A0C-A5DD-5254D96D0655"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:tp-link:tl-war1200l_firmware:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "02A26160-2484-4517-B223-40A329DAEDFA"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:tp-link:tl-war1200l:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "72F6A8BD-0012-48FA-B5D0-A6F03097FEA7"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:tp-link:tl-war1300l_firmware:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "F7B0BCD4-BE7E-4E30-8D41-5BB30EDD1F21"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:tp-link:tl-war1300l:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "0D6AE4D9-A750-4770-A07A-FC87DCA4E840"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:tp-link:tl-war1750l_firmware:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "87876AD9-B258-4E8E-ABF6-6704F6EEE468"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:tp-link:tl-war1750l:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "E888A70B-984E-4D7C-B324-2F0E9C8E57C6"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:tp-link:tl-war2600l_firmware:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "D5CD25BA-4D2F-46FE-B73B-DBFEC70F16CB"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:tp-link:tl-war2600l:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "1E4EF035-D38D-478C-BCAA-EE96EBEC9D80"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://github.com/L1ZhaoXin/Router-Vulnerability-Research/blob/master/Tplink_LUCI_Dhcps_Authenticated_RCE_Record.txt",
|
|
"source": "cve@mitre.org",
|
|
"tags": [
|
|
"Exploit",
|
|
"Issue Tracking",
|
|
"Third Party Advisory"
|
|
]
|
|
}
|
|
]
|
|
} |