CVE-2020-12109: OS Command Injection

Published May 4, 2020

Updated

Certain TP-Link devices allow Command Injection. This affects NC200 2.1.9 build 200225, NC210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 200304, NC250 1.3.0 build 200304, NC260 1.5.2 build 200304, and NC450 1.5.3 build 200304.

Affected Software

31 affected components

TP-Link Nc200 Firmware=2.1.6-160108_b

TP-Link Nc200 Firmware=2.1.9-200225

TP-Link NC200

TP-Link Nc210 Firmware=1.0.3-160229

TP-Link Nc210 Firmware=1.0.4-160412

TP-Link Nc210 Firmware=1.0.9-200304

TP-Link NC210

TP-Link Nc220 Firmware=1.2.0-170516

TP-Link Nc220 Firmware=1.3.0-180105

TP-Link Nc220 Firmware=1.3.0-200304

TP-Link NC220

TP-Link Nc230 Firmware=1.0.3-160108

TP-Link Nc230 Firmware=1.2.1-170515

TP-Link Nc230 Firmware=1.3.0-200304

TP-Link NC230

TP-Link Nc250 Firmware=1.0.8-160108

TP-Link Nc250 Firmware=1.0.10-160321

TP-Link Nc250 Firmware=1.2.1-170515

TP-Link Nc250 Firmware=1.3.0-200304

TP-Link NC250

TP-Link Nc260 Firmware=1.0.5-160804

TP-Link Nc260 Firmware=1.0.6-161114

TP-Link Nc260 Firmware=1.4.1-180720

TP-Link Nc260 Firmware=1.5.0-181123

TP-Link Nc260 Firmware=1.5.2-200304

TP-Link NC260

TP-Link Nc450 Firmware=1.0.15-160920

TP-Link Nc450 Firmware=1.1.2-161013

TP-Link Nc450 Firmware=1.3.4-171130

TP-Link Nc450 Firmware=1.5.3-200304

TP-Link NC450

Event History

May 4, 2020

CVE Published

via MITRE·03:06 PM

Data Sourced

via MITRE·03:06 PM

Description

Frequently Asked Questions

What is CVE-2020-12109?

CVE-2020-12109 is a vulnerability that allows Command Injection in certain TP-Link devices.

Which TP-Link devices are affected by CVE-2020-12109?

The TP-Link devices affected by CVE-2020-12109 are NC200 2.1.9 build 200225, NC210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 200304, NC250 1.3.0 build 200304, NC260 1.5.2 build 200304, and NC450 1.5.3 build 200304.

What is the severity of CVE-2020-12109?

CVE-2020-12109 has a severity rating of 8.8 (Critical).

How can I fix CVE-2020-12109?

To fix CVE-2020-12109, update the firmware of the affected TP-Link devices to the latest available version.

Where can I find more information about CVE-2020-12109?

You can find more information about CVE-2020-12109 on the following URLs: [1] http://packetstormsecurity.com/files/157531/TP-LINK-Cloud-Cameras-NCXXX-Bonjour-Command-Injection.html [2] http://packetstormsecurity.com/files/159222/TP-Link-Cloud-Cameras-NCXXX-Bonjour-Command-Injection.html [3] https://seclists.org/fulldisclosure/2020/May/2