CVE-2017-17757: TP-Link Tl-WAR1200L Firmware

High severity, CVSS 8.8. EPSS: 2.7% chance of exploitation in the next 30 days.

TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/wportal command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/wportal.lua in uhttpd.

Affected products

• TP-Link Tl-WAR1200L Firmware: affected versions not specified
• TP-Link Tl-WAR1300L Firmware: affected versions not specified
• TP-Link Tl-WAR1750L Firmware: affected versions not specified
• TP-Link Tl-WAR2600L Firmware: affected versions not specified
• TP-Link Tl-WAR450L Firmware: affected versions not specified
• TP-Link Tl-WAR458L Firmware: affected versions not specified
• TP-Link Tl-WAR900L Firmware: affected versions not specified
• TP-Link Tl-WVR1200L Firmware: affected versions not specified
• TP-Link Tl-WVR1300L Firmware: affected versions not specified
• TP-Link Tl-WVR1750L Firmware: affected versions not specified
• TP-Link Tl-WVR2600L Firmware: affected versions not specified
• TP-Link Tl-WVR4300L Firmware: affected versions not specified
• TP-Link Tl-WVR450L Firmware: affected versions not specified
• TP-Link Tl-WVR458L Firmware: affected versions not specified
• TP-Link Tl-WVR900L Firmware: affected versions not specified

Published 2017-12-19. Last modified 2026-06-17.