CVE-2017-8220

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow remote code execution with a single HTTP request by placing shell commands in a "host=" line within HTTP POST data.

Metrics

CVSS 3.0 9.9/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.htmlExploit, Technical Description, Third Party Advisory
https://pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.htmlExploit, Technical Description, Third Party Advisory

Timeline

Published: Apr 25, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-82217.5Wireless IP Camera (P2P) WIFICAM devices rely on a cleartext UDP tunnel protocol (aka the Cloud feature) for communication between an Androi CVE-2017-82227.5Wireless IP Camera (P2P) WIFICAM devices have an "Apple Production IOS Push Services" private RSA key and certificate stored in /system/www/CVE-2017-82237.5On Wireless IP Camera (P2P) WIFICAM devices, an attacker can use the RTSP server on port 10554/tcp to watch the streaming without authentica CVE-2017-82249.8Wireless IP Camera (P2P) WIFICAM devices have a backdoor root account that can be accessed with TELNET.CVE-2017-82259.8On Wireless IP Camera (P2P) WIFICAM devices, access to .ini files (containing credentials) is not correctly checked. An attacker can bypass CVE-2017-82269.8Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyon CVE-2017-82279.8Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have a timeout policy to wait for 5 minutes in case 30 incorrect password attempts are de CVE-2017-82288.8Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices mishandle reboots within the past two hours. Amcrest cloud services does not perform a th CVE-2017-82299.8Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials. If the firm CVE-2017-82308.8On Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices, the users on the device are divided into 2 groups "admin" and "user". However, as a p CVE-2017-82337.8In a camera driver function in all Android releases from CAF using the Linux kernel, a bounds check is missing when writing into an array po CVE-2017-82347.8In all Android releases from CAF using the Linux kernel, an out of bounds access can potentially occur in a camera function.