{"vulnerability": "CVE-2020-1088", "sightings": [{"uuid": "9a78295f-b566-41f6-823b-9ddc0dd91b9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10884", "type": "exploited", "source": "https://www.exploit-db.com/exploits/48331", "content": "", "creation_timestamp": "2020-04-16T00:00:00.000000Z"}, {"uuid": "24b64ed9-1e65-42c2-89cb-3e00b09e5a53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10882", "type": "exploited", "source": "https://www.exploit-db.com/exploits/48331", "content": "", "creation_timestamp": "2020-04-16T00:00:00.000000Z"}, {"uuid": "4af73767-8726-455e-a4c7-3a38fc4e0587", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10883", "type": "exploited", "source": "https://www.exploit-db.com/exploits/48331", "content": "", "creation_timestamp": "2020-04-16T00:00:00.000000Z"}, {"uuid": "8da17ae7-3157-4780-91f6-3afba636af70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10882", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "12caa162-fa0c-4f37-b249-e56d3f54f43f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10883", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "8662e48c-1a79-466e-9d87-02a37b4bc0b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10884", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "f0386f72-7562-463f-96f6-45e3f4b5ee41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10883", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:21.000000Z"}, {"uuid": "48202632-4203-43cd-b8e3-94c2a48619cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10884", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:21.000000Z"}, {"uuid": "13d25cb4-4f16-4306-b69f-40f2cc08f91c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10882", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:21.000000Z"}, {"uuid": "bb65749a-f6e1-4214-9f95-88b0d77c6249", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10883", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/tplink_archer_a7_c7_lan_rce.rb", "content": "", "creation_timestamp": "2020-04-15T16:34:56.000000Z"}, {"uuid": "d92392f3-aef1-42f5-88ec-d6357c44e43d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10884", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/tplink_archer_a7_c7_lan_rce.rb", "content": "", "creation_timestamp": "2020-04-15T16:34:56.000000Z"}, {"uuid": "f9254377-9343-4679-8258-2aebe74f0e82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10882", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/tplink_archer_a7_c7_lan_rce.rb", "content": "", "creation_timestamp": "2020-04-15T16:34:56.000000Z"}, {"uuid": "c447e38c-c044-4400-85c0-c2f0c4909a99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-1088", "type": "seen", "source": "https://t.me/canyoupwnme/6441", "content": "CVE-2020\u20131088 \u2014 Yet another arbitrary delete EoP\nhttps://medium.com/csis-techblog/cve-2020-1088-yet-another-arbitrary-delete-eop-a00b97d8c3e2", "creation_timestamp": "2020-05-18T18:25:35.000000Z"}, {"uuid": "48ca522b-9fe9-414a-bfde-3aadcebc9a76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-1088", "type": "seen", "source": "https://t.me/VulnerabilityNews/14731", "content": "An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1082, CVE-2020-1088.\nPublished at: May 22, 2020 at 01:15AM\nView on website", "creation_timestamp": "2020-05-22T02:46:09.000000Z"}, {"uuid": "d92d19ff-a708-4a49-bea0-2d0531761490", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10882", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/919", "content": "#exploit\nCVE-2020-10882:\nVulnerability in the tdpServer daemon (/usr/bin/tdpServer), running on the TP- Link Archer A7 (AC1750) router, hardware ver.5, MIPS, firmware ver.190726\nhttps://www.zerodayinitiative.com/blog/2020/4/6/exploiting-the-tp-link-archer-c7-at-pwn2own-tokyo", "creation_timestamp": "2022-11-27T19:31:24.000000Z"}, {"uuid": "b01a88f3-8b14-416d-b5c6-4071bdbc3031", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-1088", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/1137", "content": "#exploit\n1. CVE-2020-13118:\nMikrotik Router Monitoring System <=1.2.3 - SQLI exists in check_community.php \nvia the parameter community\nhttps://github.com/adeoluwa-adebiyi/Mikrotik-Router-Monitoring-System/issues/4\n\n2. CVE-2020-1088:\nWindows Error Reporting EoP\nhttps://medium.com/csis-techblog/cve-2020-1088-yet-another-arbitrary-delete-eop-a00b97d8c3e2\n]-> PoC: https://gist.github.com/fisboger/82c0c5c2befab226f4751e9e028912f0", "creation_timestamp": "2024-10-24T04:32:14.000000Z"}, {"uuid": "9d338005-2e15-4639-97b8-ab2c754b1cb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-1088", "type": "seen", "source": "https://t.me/cibsecurity/12233", "content": "ATENTION\u203c New - CVE-2020-1021\n\nAn elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1082, CVE-2020-1088.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-05-22T02:55:22.000000Z"}, {"uuid": "3af3860f-0c96-45c6-bb92-655f3874bc6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10882", "type": "seen", "source": "https://t.me/cibsecurity/16020", "content": "\u203c CVE-2020-28347 \u203c\n\ntdpServer on TP-Link Archer A7 AC1750 devices before 201029 allows remote attackers to execute arbitrary code via the slave_mac parameter. NOTE: this issue exists because of an incomplete fix for CVE-2020-10882 in which shell quotes are mishandled.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-08T22:54:08.000000Z"}, {"uuid": "966bbda4-8403-49f4-9426-9cc92e9f5b2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10883", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/tplink_archer_a7_c7_lan_rce.rb", "content": "{\"aliases\": [], \"arch\": \"mipsbe\", \"author\": [\"Pedro Ribeiro \", \"Radek Domanski  @RabbitPro>\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a command injection vulnerability in the tdpServer daemon (/usr/bin/tdpServer), running on\\n          the router TP-Link Archer A7/C7 (AC1750), hardware version 5, MIPS Architecture, firmware version 190726.\\n          The vulnerability can only be exploited by an attacker on the LAN side of the router, but the attacker does\\n          not need any authentication to abuse it. After exploitation, an attacker will be able to execute any command\\n          as root, including downloading and executing a binary from another host.\\n          This vulnerability was discovered and exploited at Pwn2Own Tokyo 2019 by the Flashback team (Pedro Ribeiro +\\n          Radek Domanski).\\n          This module was updated in November 2020, after a bypass was discovered for the patch TP-Link issued. The new\\n          injection technique works on older firmware too. All firmware versions up to (but excluding) releases 201029 and\\n          201030 are exploitable.\", \"disclosure_date\": \"2020-03-25\", \"fullname\": \"exploit/linux/misc/tplink_archer_a7_c7_lan_rce\", \"is_install_path\": true, \"mod_time\": \"2026-05-14 11:43:36 +0000\", \"name\": \"TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/misc/tplink_archer_a7_c7_lan_rce.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/misc/tplink_archer_a7_c7_lan_rce\", \"references\": [\"URL-https://www.thezdi.com/blog/2020/4/6/exploiting-the-tp-link-archer-c7-at-pwn2own-tokyo\", \"URL-https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2019/lao_bomb/lao_bomb.md\", \"URL-https://github.com/rdomanski/Exploits_and_Advisories/blob/master/advisories/Pwn2Own/Tokyo2019/lao_bomb.md\", \"URL-https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2020/minesweeper.md\", \"URL-https://github.com/rdomanski/Exploits_and_Advisories/blob/master/advisories/Pwn2Own/Tokyo2020/minesweeper.md\", \"CVE-2020-10882\", \"CVE-2020-10883\", \"CVE-2020-10884\", \"CVE-2020-28347\", \"ZDI-20-334\", \"ZDI-20-335\", \"ZDI-20-336\"], \"rport\": 20002, \"session_types\": false, \"targets\": [\"TP-Link Archer A7/C7 (AC1750) v5 (firmware up to 201029/30)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:19.627748Z"}, {"uuid": "b7c829d5-22e6-4450-9548-d3239f15e639", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10884", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/tplink_archer_a7_c7_lan_rce.rb", "content": "{\"aliases\": [], \"arch\": \"mipsbe\", \"author\": [\"Pedro Ribeiro \", \"Radek Domanski  @RabbitPro>\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a command injection vulnerability in the tdpServer daemon (/usr/bin/tdpServer), running on\\n          the router TP-Link Archer A7/C7 (AC1750), hardware version 5, MIPS Architecture, firmware version 190726.\\n          The vulnerability can only be exploited by an attacker on the LAN side of the router, but the attacker does\\n          not need any authentication to abuse it. After exploitation, an attacker will be able to execute any command\\n          as root, including downloading and executing a binary from another host.\\n          This vulnerability was discovered and exploited at Pwn2Own Tokyo 2019 by the Flashback team (Pedro Ribeiro +\\n          Radek Domanski).\\n          This module was updated in November 2020, after a bypass was discovered for the patch TP-Link issued. The new\\n          injection technique works on older firmware too. All firmware versions up to (but excluding) releases 201029 and\\n          201030 are exploitable.\", \"disclosure_date\": \"2020-03-25\", \"fullname\": \"exploit/linux/misc/tplink_archer_a7_c7_lan_rce\", \"is_install_path\": true, \"mod_time\": \"2026-05-14 11:43:36 +0000\", \"name\": \"TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/misc/tplink_archer_a7_c7_lan_rce.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/misc/tplink_archer_a7_c7_lan_rce\", \"references\": [\"URL-https://www.thezdi.com/blog/2020/4/6/exploiting-the-tp-link-archer-c7-at-pwn2own-tokyo\", \"URL-https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2019/lao_bomb/lao_bomb.md\", \"URL-https://github.com/rdomanski/Exploits_and_Advisories/blob/master/advisories/Pwn2Own/Tokyo2019/lao_bomb.md\", \"URL-https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2020/minesweeper.md\", \"URL-https://github.com/rdomanski/Exploits_and_Advisories/blob/master/advisories/Pwn2Own/Tokyo2020/minesweeper.md\", \"CVE-2020-10882\", \"CVE-2020-10883\", \"CVE-2020-10884\", \"CVE-2020-28347\", \"ZDI-20-334\", \"ZDI-20-335\", \"ZDI-20-336\"], \"rport\": 20002, \"session_types\": false, \"targets\": [\"TP-Link Archer A7/C7 (AC1750) v5 (firmware up to 201029/30)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:19.745125Z"}, {"uuid": "978bc1af-db80-410c-a5c0-f98f691d590f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10882", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/tplink_archer_a7_c7_lan_rce.rb", "content": "{\"aliases\": [], \"arch\": \"mipsbe\", \"author\": [\"Pedro Ribeiro \", \"Radek Domanski  @RabbitPro>\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a command injection vulnerability in the tdpServer daemon (/usr/bin/tdpServer), running on\\n          the router TP-Link Archer A7/C7 (AC1750), hardware version 5, MIPS Architecture, firmware version 190726.\\n          The vulnerability can only be exploited by an attacker on the LAN side of the router, but the attacker does\\n          not need any authentication to abuse it. After exploitation, an attacker will be able to execute any command\\n          as root, including downloading and executing a binary from another host.\\n          This vulnerability was discovered and exploited at Pwn2Own Tokyo 2019 by the Flashback team (Pedro Ribeiro +\\n          Radek Domanski).\\n          This module was updated in November 2020, after a bypass was discovered for the patch TP-Link issued. The new\\n          injection technique works on older firmware too. All firmware versions up to (but excluding) releases 201029 and\\n          201030 are exploitable.\", \"disclosure_date\": \"2020-03-25\", \"fullname\": \"exploit/linux/misc/tplink_archer_a7_c7_lan_rce\", \"is_install_path\": true, \"mod_time\": \"2026-05-14 11:43:36 +0000\", \"name\": \"TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/misc/tplink_archer_a7_c7_lan_rce.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/misc/tplink_archer_a7_c7_lan_rce\", \"references\": [\"URL-https://www.thezdi.com/blog/2020/4/6/exploiting-the-tp-link-archer-c7-at-pwn2own-tokyo\", \"URL-https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2019/lao_bomb/lao_bomb.md\", \"URL-https://github.com/rdomanski/Exploits_and_Advisories/blob/master/advisories/Pwn2Own/Tokyo2019/lao_bomb.md\", \"URL-https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2020/minesweeper.md\", \"URL-https://github.com/rdomanski/Exploits_and_Advisories/blob/master/advisories/Pwn2Own/Tokyo2020/minesweeper.md\", \"CVE-2020-10882\", \"CVE-2020-10883\", \"CVE-2020-10884\", \"CVE-2020-28347\", \"ZDI-20-334\", \"ZDI-20-335\", \"ZDI-20-336\"], \"rport\": 20002, \"session_types\": false, \"targets\": [\"TP-Link Archer A7/C7 (AC1750) v5 (firmware up to 201029/30)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:19.518201Z"}]}