CVE-2017-15631

7.2 highEPSS 4.4%

TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-workmode variable in the pptp_client.lua file.

Severity

CVSS 3.0

7.2 high

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 4.4% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
Published: 2018-01-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

tp-link:er5110g_firmware
tp-link:er5120g_firmware
tp-link:er5510g_firmware
tp-link:er5520g_firmware
tp-link:r4149g_firmware
tp-link:r4239g_firmware
tp-link:r4299g_firmware
tp-link:r473_firmware
tp-link:r473g_firmware
tp-link:r473gp-ac_firmware
tp-link:r473p-ac_firmware
tp-link:r478\+_firmware
tp-link:r478_firmware
tp-link:r478g\+_firmware
tp-link:r483_firmware
tp-link:r483g_firmware
tp-link:r488_firmware
tp-link:war1300l_firmware
tp-link:war1750l_firmware
tp-link:war2600l_firmware
tp-link:war302_firmware
tp-link:war450_firmware
tp-link:war450l_firmware
tp-link:war458_firmware
tp-link:war458l_firmware
tp-link:war900l_firmware
tp-link:wvr1300g_firmware
tp-link:wvr1300l_firmware
tp-link:wvr1750l_firmware
tp-link:wvr2600l_firmware
tp-link:wvr300_firmware
tp-link:wvr302_firmware
tp-link:wvr4300l_firmware
tp-link:wvr450_firmware
tp-link:wvr450l_firmware
tp-link:wvr458l_firmware
tp-link:wvr900g_firmware
tp-link:wvr900l_firmware

References

Check your stack JSON