| Vulnerability Name: | CVE-2018-11481 (CCN-144737) |
| Assigned: | 2018-05-28 |
| Published: | 2018-05-28 |
| Updated: | 2018-07-05 |
| Summary: | TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices allow authenticated remote code execution via crafted JSON data because /usr/lib/lua/luci/torchlight/validator.lua does not block various punctuation characters.
|
| CVSS v3 Severity: | 8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
8.2 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:R)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): High
Integrity (I): High
Availibility (A): High |
6.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
5.9 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:F/RL:U/RC:R)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low |
|
| CVSS v2 Severity: | 6.5 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance | | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial |
6.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
| | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial |
|
| Vulnerability Type: | CWE-20
|
| Vulnerability Consequences: | Gain Access |
| References: | Source: MITRE
Type: CNA
CVE-2018-11481
Source: XF
Type: UNKNOWN
tplink-cve201811481-code-exec(144737)
Source: CCN
Type: GitHub Web site
TP-LINK-websys-Authenticated-RCE
Source: MISC
Type: Third Party Advisory
https://github.com/yough3rt/IOT-pwn-for-fun/blob/master/TP-LINK-websys-Authenticated-RCE
Source: CCN
Type: TP-Link Web site
TP-link IPC Camera
|
| Vulnerable Configuration: | Configuration 1:
cpe:/o:tp-link:ipc_tl-ipc223(p)-6_firmware:*:*:*:*:*:*:*:* (Version < 1.0.21)AND cpe:/h:tp-link:ipc_tl-ipc223(p)-6:-:*:*:*:*:*:*:*
Configuration 2:
cpe:/o:tp-link:tl-ipc323k-d_firmware:*:*:*:*:*:*:*:* (Version < 1.0.21)AND cpe:/h:tp-link:tl-ipc323k-d:-:*:*:*:*:*:*:*
Configuration 3:
cpe:/o:tp-link:tl-ipc325(kp)_firmware:*:*:*:*:*:*:*:* (Version < 1.0.21)AND cpe:/h:tp-link:tl-ipc325(kp):-:*:*:*:*:*:*:*
Configuration 4:
cpe:/o:tp-link:tl-ipc40a-4_firmware:*:*:*:*:*:*:*:* (Version < 1.0.21)AND cpe:/h:tp-link:tl-ipc40a-4:-:*:*:*:*:*:*:*
 Denotes that component is vulnerable |
| BACK |