vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2017-16959

N/A
Published: November 27, 2017 at 10:00 AM UTC
Updated: June 17, 2026 at 01:10 AM UTC
104 products affected across 1 vendorTl ER5120G FirmwareTl WAR1300L FirmwareTl WVR1750L Firmware

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 2%

Description

The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence of arbitrary files by making an operation=write;locale=%0d request, and then making an operation=read request with a crafted Accept-Language HTTP header, related to the set_sysinfo and get_sysinfo functions in /usr/lib/lua/luci/controller/locale.lua in uhttpd.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Tl ER3210G Firmware· TP-Link
95%
All versions
tp-link-tl-er3210g (same device)
Tl ER3220G Firmware· TP-Link
95%
All versions
tp-link-tl-er3220g (same device)
Tl ER5110G Firmware· TP-Link
95%
All versions
tp-link-tl-er5110g (same device)
Tl ER5120G Firmware· TP-Link
95%
All versions
tp-link-tl-er5120g (same device)
Tl ER5510G Firmware· TP-Link
95%
All versions
tp-link-tl-er5510g (same device)
Tl ER5520G Firmware· TP-Link
95%
All versions
tp-link-tl-er5520g (same device)
Tl ER6110G Firmware· TP-Link
95%
All versions
tp-link-tl-er6110g (same device)
Tl ER6120G Firmware· TP-Link
95%
All versions
tp-link-tl-er6120g (same device)
Tl ER6220G Firmware· TP-Link
95%
All versions
tp-link-tl-er6220g (same device)
Tl ER6510G Firmware· TP-Link
95%
All versions
tp-link-tl-er6510g (same device)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (1)

x_refsource_MISCExploitThird Party Advisory
Source: [email protected]
https://github.com/coincoin7/Wireless-Router-Vulnerability/blob/master/TplinkLocalePathDisclosure.txt

CVSS

4MEDIUM[email protected]
Confidentiality
PARTIAL
Integrity
NONE
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-22

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card