CVE-2020-36178

Published January 6th, 2021

View on NVD ↗

CVSS v3

9.8

CRITICAL

CVSS v2

HIGH

Affected

PROJECT

Description

oal_ipt_addBridgeIsolationRules on TP-Link TL-WR840N 6_EU_0.9.1_4.16 devices allows OS command injection because a raw string entered from the web interface (an IP address field) is used directly for a call to the system library function (for iptables). NOTE: oal_ipt_addBridgeIsolationRules is not the only function that calls util_execSystem.

therealunicornsecurity/therealunicornsecurity.github.io

Build a Jekyll blog in minutes, without touching the command line.

GitHub