Intrusion Prevention

TP-Link.Cloud.Camera.sysname.OS.Command.Injection

Description

This indicates an attack attempt to exploit a Command Injection vulnerability in TP-Link Cloud Camera devices.
The vulnerability is due to insufficient sanitizing of user supplied inputs in the application. A remote attacker may be able to exploit this to execute arbitrary commands within the context of the application.

Affected Products

NC200 2.1.9 build 200225 and earlier
NC210 1.0.9 build 200304 and earlier
NC220 1.3.0 build 200304 and earlier
NC230 1.3.0 build 200304 and earlier
NC250 1.3.0 build 200304 and earlier
NC260 1.5.2 build 200304 and earlier
NC450 1.5.3 build 200304 and earlier

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

Upgrade to the latest version available from the website.
https://www.tp-link.com/us/download-center.html

CVE References

CVE-2020-12109