CVE-2017-8217 — MEDIUM (5.3)

Q: What is CVE-2017-8217?

CVE-2017-8217 is a vulnerability with a CVSS score of 5.3 (MEDIUM). TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n have too permissive iptables rules, e.g., SNMP is not blocked on any interface.

Q: How severe is CVE-2017-8217?

CVE-2017-8217 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2017-8217?

Check the references section above for vendor advisories and patch information. Affected products include: Tp-Link C2 Firmware, Tp-Link C2, Tp-Link C20I Firmware, Tp-Link C20I.

Vulnerability Description

TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n have too permissive iptables rules, e.g., SNMP is not blocked on any interface.

CVSS Score

5.3

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Tp-Link	C2 Firmware	<= 0.9.1_4.2_v0032.0_build_160706
Tp-Link	C2	-
Tp-Link	C20I Firmware	<= 0.9.1_4.2_v0032.0_build_160706
Tp-Link	C20I	-

Related Weaknesses (CWE)

CWE-862

References

https://pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.htmlExploitTechnical DescriptionThird Party Advisory
https://pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.htmlExploitTechnical DescriptionThird Party Advisory

FAQ

What is CVE-2017-8217?

CVE-2017-8217 is a vulnerability with a CVSS score of 5.3 (MEDIUM). TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n have too permissive iptables rules, e.g., SNMP is not blocked on any interface.

How severe is CVE-2017-8217?

CVE-2017-8217 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-8217?

Check the references section above for vendor advisories and patch information. Affected products include: Tp-Link C2 Firmware, Tp-Link C2, Tp-Link C20I Firmware, Tp-Link C20I.