Evil-DB LogoEvil-DB
← All CVEs

CVE-2020-12109

high · 8.8

Certain TP-Link devices allow Command Injection. This affects NC200 2.1.9 build 200225, NC210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 200304, NC250 1.3.0 build 200304, NC260 1.5.2 build 200304, and NC450 1.5.3 build 200304.

8.8
CVSS
74.3%
EPSS (exploit prob.)
99th
EPSS percentile
2020-05-04
Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

VendorProductAffected versions
tp-linknc200_firmware2.1.6
tp-linknc200_firmware2.1.9
tp-linknc200all versions
tp-linknc210_firmware1.0.3
tp-linknc210_firmware1.0.4
tp-linknc210_firmware1.0.9
tp-linknc210all versions
tp-linknc220_firmware1.2.0
tp-linknc220_firmware1.3.0
tp-linknc220_firmware1.3.0
tp-linknc220all versions
tp-linknc230_firmware1.0.3
tp-linknc230_firmware1.2.1
tp-linknc230_firmware1.3.0
tp-linknc230all versions
tp-linknc250_firmware1.0.8
tp-linknc250_firmware1.0.10
tp-linknc250_firmware1.2.1
tp-linknc250_firmware1.3.0
tp-linknc250all versions
tp-linknc260_firmware1.0.5
tp-linknc260_firmware1.0.6
tp-linknc260_firmware1.4.1
tp-linknc260_firmware1.5.0
tp-linknc260_firmware1.5.2
tp-linknc260all versions
tp-linknc450_firmware1.0.15
tp-linknc450_firmware1.1.2
tp-linknc450_firmware1.3.4
tp-linknc450_firmware1.5.3
tp-linknc450all versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-12109