{"uuid": "e3764f41-372a-4817-a680-d16d2eccf638", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-12109", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/tp_link_ncxxx_bonjour_command_injection.rb", "content": "{\"aliases\": [], \"arch\": \"mipsle\", \"author\": [\"Pietro Oliva \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"TP-Link cloud cameras NCXXX series (NC200, NC210, NC220, NC230,\\n          NC250, NC260, NC450) are vulnerable to an authenticated command\\n          injection. In all devices except NC210, despite a check on the name length in\\n          swSystemSetProductAliasCheck, no other checks are in place in order\\n          to prevent shell metacharacters from being introduced. The system name\\n          would then be used in swBonjourStartHTTP as part of a shell command\\n          where arbitrary commands could be injected and executed as root. NC210 devices\\n          cannot be exploited directly via /setsysname.cgi due to proper input\\n          validation. NC210 devices are still vulnerable since swBonjourStartHTTP\\n          did not perform any validation when reading the alias name from the\\n          configuration file. The configuration file can be written, and code\\n          execution can be achieved by combining this issue with CVE-2020-12110.\", \"disclosure_date\": \"2020-04-29\", \"fullname\": \"exploit/linux/http/tp_link_ncxxx_bonjour_command_injection\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"TP-Link Cloud Cameras NCXXX Bonjour Command Injection\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/tp_link_ncxxx_bonjour_command_injection.rb\", \"platform\": \"Linux\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/tp_link_ncxxx_bonjour_command_injection\", \"references\": [\"URL-https://nvd.nist.gov/vuln/detail/CVE-2020-12109\", \"URL-https://seclists.org/fulldisclosure/2020/May/2\", \"CVE-2020-12109\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"TP-Link NC200, NC220, NC230, NC250\", \"TP-Link NC260, NC450\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:58.726200Z"}