CVE-2020-12111: OS Command Injection

Published May 4, 2020

Updated

Certain TP-Link devices allow Command Injection. This affects NC260 1.5.2 build 200304 and NC450 1.5.3 build 200304.

Affected Software

11 affected components

TP-Link Nc260 Firmware=1.0.5-160804

TP-Link Nc260 Firmware=1.0.6-161114

TP-Link Nc260 Firmware=1.4.1-180720

TP-Link Nc260 Firmware=1.5.0-181123

TP-Link Nc260 Firmware=1.5.2-200304

TP-Link NC260

TP-Link Nc450 Firmware=1.0.15-160920

TP-Link Nc450 Firmware=1.1.2-161013

TP-Link Nc450 Firmware=1.3.4-171130

TP-Link Nc450 Firmware=1.5.3-200304

TP-Link NC450

Event History

May 4, 2020

CVE Published

via MITRE·02:05 PM

Data Sourced

via MITRE·02:05 PM

Description

Frequently Asked Questions

What is CVE-2020-12111?

CVE-2020-12111 is a vulnerability that allows Command Injection in certain TP-Link devices.

Which TP-Link devices are affected by CVE-2020-12111?

NC260 1.5.2 build 200304 and NC450 1.5.3 build 200304 are affected by CVE-2020-12111.

What is the severity of CVE-2020-12111?

CVE-2020-12111 has a severity rating of 8.8 (critical).

How can I fix CVE-2020-12111?

To fix CVE-2020-12111, it is recommended to update the firmware of the affected devices to a version that is not vulnerable.

Where can I find more information about CVE-2020-12111?

For more information about CVE-2020-12111, you can refer to the following references: [Reference 1](http://packetstormsecurity.com/files/157533/TP-LINK-Cloud-Cameras-NCXXX-SetEncryptKey-Command-Injection.html), [Reference 2](https://seclists.org/fulldisclosure/2020/May/4), [Reference 3](https://www.tp-link.com/us/security).