Command Injection Vulnerability in TP-Link WVR, WAR, and ER Devices

CVE-2017-15627

Summary

TP-Link WVR, WAR, and ER series devices have a command injection vulnerability that allows remote authenticated administrators to execute arbitrary commands. This occurs through manipulation of the new-pns variable in the pptp_client.lua file. Attackers with administrative access can exploit this weakness, potentially compromising network integrity and device security. Organizations using these devices should assess their security configurations and apply necessary updates to mitigate this risk.

References