CVE-2017-15634

7.2 highEPSS 4.4%

TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the name variable in the wportal.lua file.

Severity

CVSS 3.0

7.2 high

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 4.4% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
Published: 2018-01-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

tp-link:er5110g_firmware
tp-link:er5120g_firmware
tp-link:er5510g_firmware
tp-link:er5520g_firmware
tp-link:r4149g_firmware
tp-link:r4239g_firmware
tp-link:r4299g_firmware
tp-link:r473_firmware
tp-link:r473g_firmware
tp-link:r473gp-ac_firmware
tp-link:r473p-ac_firmware
tp-link:r478\+_firmware
tp-link:r478_firmware
tp-link:r478g\+_firmware
tp-link:r483_firmware
tp-link:r483g_firmware
tp-link:r488_firmware
tp-link:war1300l_firmware
tp-link:war1750l_firmware
tp-link:war2600l_firmware
tp-link:war302_firmware
tp-link:war450_firmware
tp-link:war450l_firmware
tp-link:war458_firmware
tp-link:war458l_firmware
tp-link:war900l_firmware
tp-link:wvr1300g_firmware
tp-link:wvr1300l_firmware
tp-link:wvr1750l_firmware
tp-link:wvr2600l_firmware
tp-link:wvr300_firmware
tp-link:wvr302_firmware
tp-link:wvr4300l_firmware
tp-link:wvr450_firmware
tp-link:wvr450l_firmware
tp-link:wvr458l_firmware
tp-link:wvr900g_firmware
tp-link:wvr900l_firmware

References

Check your stack JSON