CVE-2019-6487

Published January 18th, 2019

View on NVD ↗

CVSS v3

N/A

CVSS v2

6.5

MEDIUM

Affected

PROJECT

Description

TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, because shell metacharacters can be included in the weather get_weather_observe citycode field.

afang5472/TP-Link-WDR-Router-Command-injection_POC

CVE-2019-6487. A command injection vulnerability in TP-Link WDR5620 Series up to verion 3.

GitHub