CVE-2017-15634

Vulnerability

A command injection vulnerability exists in the wportal.lua file of TP-Link WVR, WAR, and ER series devices. The name variable is not sanitized before being passed to a command execution function. Affected firmware versions are not specified in the public advisory [1], but the vulnerability is confirmed across multiple device families.

Exploitation

An authenticated remote administrator with access to the device's web interface can exploit this by sending a crafted POST request to the vulnerable endpoint, injecting OS commands into the name parameter. No additional privileges or user interaction is required beyond valid admin credentials [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system with root privileges, leading to full compromise of the device (confidentiality, integrity, and availability) [1].

Mitigation

As of the publication date (2018-01-11), no official firmware patch has been released by TP-Link. Affected users should restrict administrative access to trusted networks only and monitor for vendor updates. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog [1].