yough3rt/IOT-pwn-for-fun

Releases0

Stars9

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2018-11481 ↗	May 30, 2018Wednesday, 30 May 2018, 21:29	—	6.5 MEDIUM
TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices allow authenticated remote code execution via crafted JSON data because /usr/lib/lua/luci/torchlight/validator.lua does not block various punctuation characters.
CVE-2018-11482 ↗	May 30, 2018Wednesday, 30 May 2018, 21:29	—	7.5 HIGH
/usr/lib/lua/luci/websys.lua on TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices has a hardcoded zMiVw8Kw0oxKXL0 password.