製品・ソフトウェアに関する情報

JVN脆弱性詳細

複数の TP-Link デバイスにおけるコマンドインジェクションの脆弱性

Title	複数の TP-Link デバイスにおけるコマンドインジェクションの脆弱性
Summary	TP-Link WVR、WAR、および ER デバイスには、コマンドインジェクションの脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Oct. 13, 2017, midnight
Registration Date	Feb. 6, 2018, 4:53 p.m.
Last Update	Feb. 6, 2018, 4:53 p.m.

CVSS3.0 : 重要
Score	7.2
Vector	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS2.0 : 危険
Score	9
Vector	AV:N/AC:L/Au:S/C:C/I:C/A:C

Affected System

TP-LINK Technologies

TL-ER5110G ファームウェア

TL-ER5120G ファームウェア

TL-ER5510G ファームウェア

TL-ER5520G ファームウェア

TL-R4149G ファームウェア

TL-R4239G ファームウェア

TL-R4299G ファームウェア

TL-R473 ファームウェア

TL-R473G ファームウェア

TL-R473GP-AC ファームウェア

TL-R473P-AC ファームウェア

TL-R478 ファームウェア

TL-R478+ ファームウェア

TL-R478G+ ファームウェア

TL-R483 ファームウェア

TL-R483G ファームウェア

TL-R488 ファームウェア

TL-WAR1300L ファームウェア

TL-WAR1750L ファームウェア

TL-WAR2600L ファームウェア

TL-WAR302 ファームウェア

TL-WAR450 ファームウェア

TL-WAR450L ファームウェア

TL-WAR458 ファームウェア

TL-WAR458L ファームウェア

TL-WAR900L ファームウェア

TL-WVR1300G ファームウェア

TL-WVR1300L ファームウェア

TL-WVR1750L ファームウェア

TL-WVR2600L ファームウェア

TL-WVR300 ファームウェア

TL-WVR302 ファームウェア

TL-WVR4300L ファームウェア

TL-WVR450 ファームウェア

TL-WVR450L ファームウェア

TL-WVR458L ファームウェア

TL-WVR900G ファームウェア

TL-WVR900L ファームウェア

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-15614	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15614
National Vulnerability Database (NVD)
2	CVE-2017-15614	https://nvd.nist.gov/vuln/detail/CVE-2017-15614

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-77	https://cwe.mitre.org/data/definitions/77.html

ベンダー情報

No	Name	URL
TP-LINK Technologies
1	Top Page	http://www.tp-link.com/us/

その他

No	Name	URL
関連文書
1	Multiple vulnerabilities in TP-Link products(CVE-2017-15613 to CVE-2017-15637)	http://www.securityfocus.com/archive/1/archive/1/541655/100/0/threaded

Change Log

No	Changed Details	Date of change
0	[2018年02月06日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2017-15614

Summary	TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-outif variable in the pptp_client.lua file.
Publication Date	Jan. 12, 2018, 1:29 a.m.
Registration Date	Jan. 26, 2021, 1:17 p.m.
Last Update	Nov. 21, 2024, 12:14 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:tp-link:er5110g_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:er5110g:-:::::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:tp-link:er5120g_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:er5120g:-:::::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:tp-link:er5510g_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:er5510g:-:::::::*

Configuration4		or higher	or less	more than	less than
cpe:2.3:o:tp-link:er5520g_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:er5520g:-:::::::*

Configuration5		or higher	or less	more than	less than
cpe:2.3:o:tp-link:r4149g_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:r4149g:-:::::::*

Configuration6		or higher	or less	more than	less than
cpe:2.3:o:tp-link:r4239g_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:r4239g:-:::::::*

Configuration7		or higher	or less	more than	less than
cpe:2.3:o:tp-link:r4299g_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:r4299g:-:::::::*

Configuration8		or higher	or less	more than	less than
cpe:2.3:o:tp-link:r473gp-ac_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:r473gp-ac:-:::::::*

Configuration9		or higher	or less	more than	less than
cpe:2.3:o:tp-link:r473g_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:r473g:-:::::::*

Configuration10		or higher	or less	more than	less than
cpe:2.3:o:tp-link:r473p-ac_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:r473p-ac:-:::::::*

Configuration11		or higher	or less	more than	less than
cpe:2.3:o:tp-link:r473_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:r473:-:::::::*

Configuration12		or higher	or less	more than	less than
cpe:2.3:o:tp-link:r478g\+_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:r478g\+:-:::::::*

Configuration13		or higher	or less	more than	less than
cpe:2.3:o:tp-link:r478_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:r478:-:::::::*

Configuration14		or higher	or less	more than	less than
cpe:2.3:o:tp-link:r478\+_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:r478\+:-:::::::*

Configuration15		or higher	or less	more than	less than
cpe:2.3:o:tp-link:r483g_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:r483g:-:::::::*

Configuration16		or higher	or less	more than	less than
cpe:2.3:o:tp-link:r483_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:r483:-:::::::*

Configuration17		or higher	or less	more than	less than
cpe:2.3:o:tp-link:r488_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:r488:-:::::::*

Configuration18		or higher	or less	more than	less than
cpe:2.3:o:tp-link:war1300l_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:war1300l:-:::::::*

Configuration19		or higher	or less	more than	less than
cpe:2.3:o:tp-link:war1750l_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:war1750l:-:::::::*

Configuration20		or higher	or less	more than	less than
cpe:2.3:o:tp-link:war2600l_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:war2600l:-:::::::*

Configuration21		or higher	or less	more than	less than
cpe:2.3:o:tp-link:war302_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:war302:-:::::::*

Configuration22		or higher	or less	more than	less than
cpe:2.3:o:tp-link:war450l_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:war450l:-:::::::*

Configuration23		or higher	or less	more than	less than
cpe:2.3:o:tp-link:war450_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:war450:-:::::::*

Configuration24		or higher	or less	more than	less than
cpe:2.3:o:tp-link:war458l_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:war458l:-:::::::*

Configuration25		or higher	or less	more than	less than
cpe:2.3:o:tp-link:war458_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:war458:-:::::::*

Configuration26		or higher	or less	more than	less than
cpe:2.3:o:tp-link:war900l_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:war900l:-:::::::*

Configuration27		or higher	or less	more than	less than
cpe:2.3:o:tp-link:wvr1300g_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:wvr1300g:-:::::::*

Configuration28		or higher	or less	more than	less than
cpe:2.3:o:tp-link:wvr1300l_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:wvr1300l:-:::::::*

Configuration29		or higher	or less	more than	less than
cpe:2.3:o:tp-link:wvr1750l_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:wvr1750l:-:::::::*

Configuration30		or higher	or less	more than	less than
cpe:2.3:o:tp-link:wvr2600l_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:wvr2600l:-:::::::*

Configuration31		or higher	or less	more than	less than
cpe:2.3:o:tp-link:wvr300_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:wvr300:-:::::::*

Configuration32		or higher	or less	more than	less than
cpe:2.3:o:tp-link:wvr302_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:wvr302:-:::::::*

Configuration33		or higher	or less	more than	less than
cpe:2.3:o:tp-link:wvr4300l_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:wvr4300l:-:::::::*

Configuration34		or higher	or less	more than	less than
cpe:2.3:o:tp-link:wvr450l_firmware:1.0161125:::::::*
execution environment
1	cpe:2.3:h:tp-link:wvr450l:-:::::::*

Configuration35		or higher	or less	more than	less than
cpe:2.3:o:tp-link:wvr450_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:wvr450:-:::::::*

Configuration36		or higher	or less	more than	less than
cpe:2.3:o:tp-link:wvr458l_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:wvr458l:-:::::::*

Configuration37		or higher	or less	more than	less than
cpe:2.3:o:tp-link:wvr900g_firmware:3.0_170306:::::::*
execution environment
1	cpe:2.3:h:tp-link:wvr900g:-:::::::*

Configuration38		or higher	or less	more than	less than
cpe:2.3:o:tp-link:wvr900l_firmware:-:::::::*
execution environment
1	cpe:2.3:h:tp-link:wvr900l:-:::::::*

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/archive/1/541655/100/0/threaded	Exploit Third Party Advisory VDB Entry
2	http://www.securityfocus.com/archive/1/541655/100/0/threaded	Exploit Third Party Advisory VDB Entry
3	https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt	Exploit Third Party Advisory
4	https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt	Exploit Third Party Advisory

Common Vulnerabilities List