Unscored CVE-2017-15631 EUVD-2017-7082GHSA-mv8w-3vcm-847w

TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-wo…

Published Jan 11, 2018 · Updated Aug 5, 2024 · Assigned by mitre

Description

TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-workmode variable in the pptp_client.lua file.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	yubikey-manager	4.0.3-1.3	openSUSE-SU-2024:11538-1

Advisories 1

openSUSE-SU-2024:11538-1 yubikey-manager-4.0.3-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026

References

https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt
20180110 Multiple vulnerabilities in TP-Link products(CVE-2017-15613 to CVE-2017-15637) mailing-list