CVE-2020-12109

EPSS 74.3%

Vexday Risk Score

40Atención

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

Madurez del exploit

Exploit funcional

Exploit automatizable disponible (Nuclei/Metasploit).

CVSS —EPSS 74.3%KEV nãoPoC —Nuclei —Metasploit simPatch —

Ciclo de vida

29 abr 2020Exploit Metasploit disponible

04 may 2020Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

Certain TP-Link devices allow Command Injection. This affects NC200 2.1.9 build 200225, NC210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 200304, NC250 1.3.0 build 200304, NC260 1.5.2 build 200304, and NC450 1.5.3 build 200304.

Productos afectados

n/a · n/a

Referencias

http://packetstormsecurity.com/files/157531/TP-LINK-Cloud-Cameras-NCXXX-Bonjour-Command-Injection.html http://packetstormsecurity.com/files/159222/TP-Link-Cloud-Cameras-NCXXX-Bonjour-Command-Injection.html https://seclists.org/fulldisclosure/2020/May/2 https://www.tp-link.com/us/security