CVE-2019-6487: TP-Link Tl-WDR3500 Firmware

High severity, CVSS 8.8. EPSS: 8.5% chance of exploitation in the next 30 days.

TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, because shell metacharacters can be included in the weather get_weather_observe citycode field.

Affected products

• TP-Link Tl-WDR3500 Firmware: up to and including 3.0
• TP-Link Tl-WDR3600 Firmware: up to and including 3.0
• TP-Link Tl-WDR4300 Firmware: up to and including 3.0
• TP-Link Tl-WDR4900 Firmware: up to and including 3.0
• TP-Link Tl-WDR5620 Firmware: up to and including 3.0

Published 2019-01-18. Last modified 2026-06-17.