CVE-2013-2578

HighPublished

cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware...

Published: Oct 11, 2013
Updated: Sep 16, 2024
Assigning CNA: mitre
Evidence observed: Aug 2, 2013

Primary CVSS

10.0/ 10High

nvd · CVSS 2.0

AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS probability estimate

73.7%

High · next 30 days

Percentile: 99.5%
Model date: Oct 14, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6 allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the ServerName parameter and (2) other unspecified parameters.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Module

TP-Link SC2020n Authenticated Telnet InjectionModule
modules/exploits/linux/http/tp_link_sc2020n_authenticated_telnet_injection.rb
Metasploit Framework modules
ExploitEvidence observed: Sep 26, 2026Revision: be32cd78a532Related tool
Declared conditions
- platform: Unix($.exploit_linux/http/tp_link_sc2020n_authenticated_telnet_injection.platform)
- verification: check_not_declared($.exploit_linux/http/tp_link_sc2020n_authenticated_telnet_injection.check)

TP-Link TL-SC3171 IP Cameras - Multiple VulnerabilitiesExploit

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.