afang5472/TP-Link-WDR-Router-Command-injection_POC

afang5472/TP-Link-WDR-Router-Command-injection_POC

GitHubGitHub
GitHubgithub.com
Releases0
Stars38
CVE-2019-6487. A command injection vulnerability in TP-Link WDR5620 Series up to verion 3.
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2019-6487↗
—6.5 MEDIUM

TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, because shell metacharacters can be included in the weather get_weather_observe citycode field.