{"id":"CVE-2020-36178","aliases":["EUVD-2020-23756","GHSA-qqg6-4j54-68gr"],"status":"published","title":"oal_ipt_addBridgeIsolationRules on TP-Link TL-WR840N 6_EU_0.9.1_4.16 devices allows OS command...","description":"oal_ipt_addBridgeIsolationRules on TP-Link TL-WR840N 6_EU_0.9.1_4.16 devices allows OS command injection because a raw string entered from the web interface (an IP address field) is used directly for a call to the system library function (for iptables). NOTE: oal_ipt_addBridgeIsolationRules is not the only function that calls util_execSystem.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.09816,"percentile":0.95584,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2021-01-06T20:57:57Z","modified":"2026-06-17T03:14:54Z","products":[{"vendor":"tp-link","product":"tl-wr840n_firmware"}],"references":[{"url":"https://www.tp-link.com/fr/support/download/tl-wr840n/v6/#Firmware","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://therealunicornsecurity.github.io/TPLink/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://github.com/therealunicornsecurity/therealunicornsecurity.github.io/blob/master/_posts/2020-10-11-TPLink.md","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36178"},{"url":"https://github.com/advisories/GHSA-qqg6-4j54-68gr"}],"sources":{"cve":[{"id":"CVE-2020-36178","description":"oal_ipt_addBridgeIsolationRules on TP-Link TL-WR840N 6_EU_0.9.1_4.16 devices allows OS command injection because a raw string entered from the web interface (an IP address field) is used directly for a call to the system library function (for iptables). NOTE: oal_ipt_addBridgeIsolationRules is not the only function that calls util_execSystem.","status":"published","published":"2021-01-06T20:57:57Z","modified":"2024-08-04T17:23:09.407Z","updated_at":"2026-11-02T14:35:55.128961Z"}],"euvd":[{"id":"EUVD-2020-23756","description":"oal_ipt_addBridgeIsolationRules on TP-Link TL-WR840N 6_EU_0.9.1_4.16 devices allows OS command injection because a raw string entered from the web interface (an IP address field) is used directly for a call to the system library function (for iptables). NOTE: oal_ipt_addBridgeIsolationRules is not the only function that calls util_execSystem.","status":"published","published":"2021-01-06T20:57:57Z","modified":"2024-08-04T17:23:09Z","updated_at":"2026-11-03T03:07:04.065361Z"}],"ghsa":[{"id":"GHSA-qqg6-4j54-68gr","title":"oal_ipt_addBridgeIsolationRules on TP-Link TL-WR840N 6_EU_0.9.1_4.16 devices allows OS command...","description":"oal_ipt_addBridgeIsolationRules on TP-Link TL-WR840N 6_EU_0.9.1_4.16 devices allows OS command injection because a raw string entered from the web interface (an IP address field) is used directly for a call to the system library function (for iptables).","status":"published","published":"2022-05-24T17:38:07Z","modified":"2023-01-29T05:04:56Z","cwes":["CWE-78"],"updated_at":"2026-11-02T14:45:40.727657Z"}],"nvd":[{"id":"CVE-2020-36178","description":"oal_ipt_addBridgeIsolationRules on TP-Link TL-WR840N 6_EU_0.9.1_4.16 devices allows OS command injection because a raw string entered from the web interface (an IP address field) is used directly for a call to the system library function (for iptables). NOTE: oal_ipt_addBridgeIsolationRules is not the only function that calls util_execSystem.","status":"published","published":"2021-01-06T21:15:14.317Z","modified":"2026-06-17T03:14:54.61Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:06:28.892872Z"}]}}