CVE-2017-16957: TP-Link Tl-ER3210G Firmware

High severity, CVSS 8.8. EPSS: 5.6% chance of exploitation in the next 30 days.

TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the iface field of an admin/diagnostic command to cgi-bin/luci, related to the zone_get_effect_devices function in /usr/lib/lua/luci/controller/admin/diagnostic.lua in uhttpd.

Affected products

TP-Link Tl-ER3210G Firmware: affected versions not specified
TP-Link Tl-ER3220G Firmware: affected versions not specified
TP-Link Tl-ER5110G Firmware: affected versions not specified
TP-Link Tl-ER5120G Firmware: affected versions not specified
TP-Link Tl-ER5510G Firmware: affected versions not specified
TP-Link Tl-ER5520G Firmware: affected versions not specified
TP-Link Tl-ER6110G Firmware: affected versions not specified
TP-Link Tl-ER6120G Firmware: affected versions not specified
TP-Link Tl-ER6220G Firmware: affected versions not specified
TP-Link Tl-ER6510G Firmware: affected versions not specified
TP-Link Tl-ER6520G Firmware: affected versions not specified
TP-Link Tl-ER7520G Firmware: affected versions not specified
TP-Link Tl-r4149g Firmware: affected versions not specified
TP-Link Tl-r4239g Firmware: affected versions not specified
TP-Link Tl-r4299g Firmware: affected versions not specified
TP-Link Tl-r473 Firmware: affected versions not specified
TP-Link Tl-r473g Firmware: affected versions not specified
TP-Link Tl-r473p-Ac Firmware: affected versions not specified
TP-Link Tl-r478+ Firmware: affected versions not specified
TP-Link Tl-r478 Firmware: affected versions not specified
TP-Link Tl-r478g+ Firmware: affected versions not specified
TP-Link Tl-r478g Firmware: affected versions not specified
TP-Link Tl-r479gp-Ac Firmware: affected versions not specified
TP-Link Tl-r479gpe-Ac Firmware: affected versions not specified
TP-Link Tl-r479p-Ac Firmware: affected versions not specified
and 28 more

Published 2017-11-27. Last modified 2026-06-17.