CVE-2017-8220 Command injection in n/a

Critical 9.9 Published 25 Apr 2017 Updated 17 Sep 2024

Remote attackers can execute arbitrary shell commands on TP-Link C2 and C20i cameras via a crafted HTTP POST request.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-8220?

CVE-2017-8220 is a critical command injection vulnerability in n/a, published on 25 Apr 2017. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow remote code execution with a single HTTP request by placing shell commands in a "host=" line within HTTP POST data.

Weakness: CWE-78

Which versions are affected by CVE-2017-8220?

It affects 2 products.

Products include Tp-Link C20i Firmware, Tp-Link C2 Firmware.

How do I fix CVE-2017-8220?

No fix has been published for CVE-2017-8220 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2017-8220 being exploited?

There is no known exploitation of CVE-2017-8220 in the wild and no public exploit code.

Sources

Also known as GHSA-pvw8-rm83-r74w.