What’s Vulnerable › Vulnerabilities

CVE-2017-15624

• Severity: high (CVSS 7.2 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-01-11 · updated 2026-06-17

Description

TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-authtype variable in the pptp_server.lua file.

Affected products

• TP-Link Er5110G Firmware: all versions
• TP-Link Er5120G Firmware: all versions
• TP-Link Er5510G Firmware: all versions
• TP-Link Er5520G Firmware: all versions
• TP-Link R4149G Firmware: all versions
• TP-Link R4239G Firmware: all versions
• TP-Link R4299G Firmware: all versions
• TP-Link R473 Firmware: all versions
• TP-Link R473G Firmware: all versions
• TP-Link R473Gp-Ac Firmware: all versions
• TP-Link R473P-Ac Firmware: all versions
• TP-Link R478+ Firmware: all versions
• TP-Link R478 Firmware: all versions
• TP-Link R478G+ Firmware: all versions
• TP-Link R483 Firmware: all versions
• TP-Link R483G Firmware: all versions
• TP-Link R488 Firmware: all versions
• TP-Link War1300L Firmware: all versions
• TP-Link War1750L Firmware: all versions
• TP-Link War2600L Firmware: all versions
• TP-Link War302 Firmware: all versions
• TP-Link War450 Firmware: all versions
• TP-Link War450L Firmware: all versions
• TP-Link War458 Firmware: all versions
• TP-Link War458L Firmware: all versions
• TP-Link War900L Firmware: all versions
• TP-Link Wvr1300G Firmware: all versions
• TP-Link Wvr1300L Firmware: all versions
• TP-Link Wvr1750L Firmware: all versions
• TP-Link Wvr2600L Firmware: all versions

References

• http://www.securityfocus.com/archive/1/541655/100/0/threaded
• https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt
• http://www.securityfocus.com/archive/1/541655/100/0/threaded
• https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt

Get alerted when CVE-2017-15624 or the next vulnerability affects your stack