CVE-2017-17757

Summary

CVE	CVE-2017-17757
State	PUBLISHED
Assigner	mitre
Source Priority	CVE Program / NVD first with legacy fallback
Published	2017-12-19 07:29:00 UTC
Updated	2025-04-20 01:37:25 UTC
Description	TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/wportal command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/wportal.lua in uhttpd.

Primary CVSS: v3.0 8.8 HIGH from [email protected]

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.012770000 probability, percentile 0.797580000 (date 2026-05-18)

Problem Types: CWE-78 | n/a

Version	Source	Type	Score	Severity	Vector
3.0	[email protected]	Primary	8.8	HIGH	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
2.0	[email protected]	Primary	9		`AV:N/AC:L/Au:S/C:C/I:C/A:C`

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Access Vector

Network

Access Complexity

Low

Authentication

Single

Confidentiality

Complete

Integrity

Complete

Availability

Complete

AV:N/AC:L/Au:S/C:C/I:C/A:C

Type	Vendor	Product	Version	Update	Edition	Language
Hardware	Tp-link	Tl-war1200l	-	All	All	All
Operating System	Tp-link	Tl-war1200l Firmware	-	All	All	All
Hardware	Tp-link	Tl-war1300l	-	All	All	All
Operating System	Tp-link	Tl-war1300l Firmware	-	All	All	All
Hardware	Tp-link	Tl-war1750l	-	All	All	All
Operating System	Tp-link	Tl-war1750l Firmware	-	All	All	All
Hardware	Tp-link	Tl-war2600l	-	All	All	All
Operating System	Tp-link	Tl-war2600l Firmware	-	All	All	All
Hardware	Tp-link	Tl-war450l	-	All	All	All
Operating System	Tp-link	Tl-war450l Firmware	-	All	All	All
Hardware	Tp-link	Tl-war458l	-	All	All	All
Operating System	Tp-link	Tl-war458l Firmware	-	All	All	All
Hardware	Tp-link	Tl-war900l	-	All	All	All
Operating System	Tp-link	Tl-war900l Firmware	-	All	All	All
Hardware	Tp-link	Tl-wvr1200l	-	All	All	All
Operating System	Tp-link	Tl-wvr1200l Firmware	-	All	All	All
Hardware	Tp-link	Tl-wvr1300l	-	All	All	All
Operating System	Tp-link	Tl-wvr1300l Firmware	-	All	All	All
Hardware	Tp-link	Tl-wvr1750l	-	All	All	All
Operating System	Tp-link	Tl-wvr1750l Firmware	-	All	All	All
Hardware	Tp-link	Tl-wvr2600l	-	All	All	All
Operating System	Tp-link	Tl-wvr2600l Firmware	-	All	All	All
Hardware	Tp-link	Tl-wvr4300l	-	All	All	All
Operating System	Tp-link	Tl-wvr4300l Firmware	-	All	All	All
Hardware	Tp-link	Tl-wvr450l	-	All	All	All
Operating System	Tp-link	Tl-wvr450l Firmware	-	All	All	All
Hardware	Tp-link	Tl-wvr458l	-	All	All	All
Operating System	Tp-link	Tl-wvr458l Firmware	-	All	All	All
Hardware	Tp-link	Tl-wvr900l	-	All	All	All
Operating System	Tp-link	Tl-wvr900l Firmware	-	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified

Reference	Source	Link	Tags
Router-Vulnerability-Research/Tplink_LUCI_Wechat_Authenticated_RCE_Record.txt at master · L1ZhaoXin/Router-Vulnerability-Research · GitHub	af854a3a-2127-422b-91ae-364da2661108	github.com	Exploit, Issue Tracking, Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.