CVE-2017-16959: TP-Link Tl-ER3210G Firmware

Medium severity, CVSS 6.5. EPSS: 1.9% chance of exploitation in the next 30 days.

The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence of arbitrary files by making an operation=write;locale=%0d request, and then making an operation=read request with a crafted Accept-Language HTTP header, related to the set_sysinfo and get_sysinfo functions in /usr/lib/lua/luci/controller/locale.lua in uhttpd.

Affected products

  • TP-Link Tl-ER3210G Firmware: affected versions not specified
  • TP-Link Tl-ER3220G Firmware: affected versions not specified
  • TP-Link Tl-ER5110G Firmware: affected versions not specified
  • TP-Link Tl-ER5120G Firmware: affected versions not specified
  • TP-Link Tl-ER5510G Firmware: affected versions not specified
  • TP-Link Tl-ER5520G Firmware: affected versions not specified
  • TP-Link Tl-ER6110G Firmware: affected versions not specified
  • TP-Link Tl-ER6120G Firmware: affected versions not specified
  • TP-Link Tl-ER6220G Firmware: affected versions not specified
  • TP-Link Tl-ER6510G Firmware: affected versions not specified
  • TP-Link Tl-ER6520G Firmware: affected versions not specified
  • TP-Link Tl-ER7520G Firmware: affected versions not specified
  • TP-Link Tl-r4149g Firmware: affected versions not specified
  • TP-Link Tl-r4239g Firmware: affected versions not specified
  • TP-Link Tl-r4299g Firmware: affected versions not specified
  • TP-Link Tl-r473 Firmware: affected versions not specified
  • TP-Link Tl-r473g Firmware: affected versions not specified
  • TP-Link Tl-r473p-Ac Firmware: affected versions not specified
  • TP-Link Tl-r478+ Firmware: affected versions not specified
  • TP-Link Tl-r478 Firmware: affected versions not specified
  • TP-Link Tl-r478g+ Firmware: affected versions not specified
  • TP-Link Tl-r478g Firmware: affected versions not specified
  • TP-Link Tl-r479gp-Ac Firmware: affected versions not specified
  • TP-Link Tl-r479gpe-Ac Firmware: affected versions not specified
  • TP-Link Tl-r479p-Ac Firmware: affected versions not specified
  • and 28 more

Published 2017-11-27. Last modified 2026-06-17.