TP-Link NC220 Firmware vulnerabilities

5 CVEs affecting TP-Link NC220 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-13224, published 2020-06-17.

More from TP-Link.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-12109, published 2020-05-04. High severity, CVSS 8.8. EPSS: 74.3% chance of exploitation in the next 30 days. Certain TP-Link devices allow Command Injection. This affects NC200 2.1.9 build 200225, NC210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 200304, NC250 1.3.0 build 200304, NC260…
• CVE-2020-12110, published 2020-05-04. Critical severity, CVSS 9.8. EPSS: 13.6% chance of exploitation in the next 30 days. Certain TP-Link devices have a Hardcoded Encryption Key. This affects NC200 2.1.9 build 200225, N210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 200304, NC250 1.3.0 build 200304,…
• CVE-2020-10231, published 2020-04-01. High severity, CVSS 7.5. EPSS: 3.8% chance of exploitation in the next 30 days. TP-Link NC200 through 2.1.8_Build_171109, NC210 through 1.0.9_Build_171214, NC220 through 1.3.0_Build_180105, NC230 through 1.3.0_Build_171205, NC250 through 1.3.0_Build_171205, NC260 through…
• CVE-2020-13224, published 2020-06-17. High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days. TP-LINK NC200 devices through 2.1.10 build 200401, NC210 devices through 1.0.10 build 200401, NC220 devices through 1.3.1 build 200401, NC230 devices through 1.3.1 build 200401, NC250 devices through…
• CVE-2020-11445, published 2020-04-01. Medium severity, CVSS 5.3. EPSS: 1.8% chance of exploitation in the next 30 days. TP-Link cloud cameras through 2020-02-09 allow remote attackers to bypass authentication and obtain sensitive information via vectors involving a Wi-Fi session with GPS enabled, aka CNVD-2020-04855.