CVE-2017-16960: TP-Link Tl-ER3210G Firmware

High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days.

TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the t_bindif field of an admin/interface command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/interface.lua in uhttpd.

Affected products

• TP-Link Tl-ER3210G Firmware: affected versions not specified
• TP-Link Tl-ER3220G Firmware: any version
• TP-Link Tl-ER5110G Firmware: affected versions not specified
• TP-Link Tl-ER5120G Firmware: affected versions not specified
• TP-Link Tl-ER5510G: version v2 only; version v3 only
• TP-Link Tl-ER5520G: version v2 only; version v3 only
• TP-Link Tl-ER6110G Firmware: affected versions not specified
• TP-Link Tl-ER6120G: version v2 only
• TP-Link Tl-ER6220G Firmware: affected versions not specified
• TP-Link Tl-ER6510G Firmware: affected versions not specified
• TP-Link Tl-ER6520G: version v2 only; version v3 only
• TP-Link Tl-ER7520G Firmware: affected versions not specified
• TP-Link Tl-r4149g Firmware: affected versions not specified
• TP-Link Tl-r4239g: version v2 only
• TP-Link Tl-r4299g: version v2 only
• TP-Link Tl-r473: version v5 only
• TP-Link Tl-r473g Firmware: affected versions not specified
• TP-Link Tl-r473gp-Ac Firmware: affected versions not specified
• TP-Link Tl-r473p-Ac Firmware: affected versions not specified
• TP-Link Tl-r478: version v6 only
• TP-Link Tl-r478+: version v7 only
• TP-Link Tl-r478g+: version v3 only
• TP-Link Tl-r478g Firmware: affected versions not specified
• TP-Link Tl-r479gp-Ac Firmware: affected versions not specified
• TP-Link Tl-r479gpe-Ac Firmware: affected versions not specified
• and 30 more

Published 2017-11-27. Last modified 2026-06-17.