TP-Link Tl-ER5120G Firmware vulnerabilities

7 CVEs affecting TP-Link Tl-ER5120G Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-43135, published 2023-09-20.

More from TP-Link.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-16957, published 2017-11-27. High severity, CVSS 8.8. EPSS: 5.6% chance of exploitation in the next 30 days. TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the iface field of an admin/diagnostic command to…
• CVE-2017-16958, published 2017-11-27. High severity, CVSS 8.8. EPSS: 2.9% chance of exploitation in the next 30 days. TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the t_bindif field of an admin/bridge command to…
• CVE-2023-43138, published 2023-09-20. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds NAPT rules after authentication, and the rule name has an injection point.
• CVE-2023-43137, published 2023-09-20. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds ACL rules after authentication, and the rule name parameter has injection points.
• CVE-2017-16960, published 2017-11-27. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the t_bindif field of an admin/interface command to…
• CVE-2017-16959, published 2017-11-27. Medium severity, CVSS 6.5. EPSS: 1.9% chance of exploitation in the next 30 days. The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence of arbitrary files by making an…
• CVE-2023-43135, published 2023-09-20. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. There is an unauthorized access vulnerability in TP-LINK ER5120G 4.0 2.0.0 Build 210817 Rel.80868n, which allows attackers to obtain sensitive information of the device without authentication, obtain…