CVE-2017-15620: TP-Link ER5110G Firmware

High severity, CVSS 7.2. EPSS: 4.4% chance of exploitation in the next 30 days.

TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-zone variable in the ipmac_import.lua file.

Affected products

• TP-Link ER5110G Firmware: affected versions not specified
• TP-Link ER5120G Firmware: affected versions not specified
• TP-Link ER5510G Firmware: affected versions not specified
• TP-Link ER5520G Firmware: affected versions not specified
• TP-Link r4149g Firmware: affected versions not specified
• TP-Link r4239g Firmware: affected versions not specified
• TP-Link r4299g Firmware: affected versions not specified
• TP-Link r473 Firmware: affected versions not specified
• TP-Link r473g Firmware: affected versions not specified
• TP-Link r473gp-Ac Firmware: affected versions not specified
• TP-Link r473p-Ac Firmware: affected versions not specified
• TP-Link r478+ Firmware: affected versions not specified
• TP-Link r478 Firmware: affected versions not specified
• TP-Link r478g+ Firmware: affected versions not specified
• TP-Link r483 Firmware: affected versions not specified
• TP-Link r483g Firmware: affected versions not specified
• TP-Link r488 Firmware: affected versions not specified
• TP-Link WAR1300L Firmware: affected versions not specified
• TP-Link WAR1750L Firmware: affected versions not specified
• TP-Link WAR2600L Firmware: affected versions not specified
• TP-Link WAR302 Firmware: affected versions not specified
• TP-Link WAR450 Firmware: affected versions not specified
• TP-Link WAR450L Firmware: affected versions not specified
• TP-Link WAR458 Firmware: affected versions not specified
• TP-Link WAR458L Firmware: affected versions not specified
• and 13 more

Published 2018-01-11. Last modified 2026-06-17.