CVE-2017-15635

TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the max_conn variable in the session_limits.lua file.

CVSS v3.0

7.2 HIGHCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

4.37% chance of exploitation in the next 30 days, 91th percentile

Published

2018-01-11

Updated

2024-08-05

Proof-of-concept exploits (1)

• chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt

References

• CVE Record
• NVD entry

Related

• CVE-2017-15613
• CVE-2017-15614
• CVE-2017-15615
• CVE-2017-15616
• CVE-2017-15617
• CVE-2017-15618