# TP-LINK Tapo C200 远程代码执行漏洞
## 概述
TP-Link Tapo C200 摄像头在1.1.15及以下固件版本中存在一个未授权的远程代码执行漏洞，该漏洞存在于默认以root权限运行的uhttpd二进制文件中。利用此漏洞，攻击者可以完全控制摄像头。
## 影响版本
- 1.1.15及以下版本
## 细节
漏洞存在于默认以root权限运行的uhttpd二进制文件中。未授权的远程代码执行漏洞允许攻击者无需认证即可执行任意代码。
## 影响
攻击者可以完全控制受影响的摄像头，从而可能导致数据泄露、摄像头操作被操控等严重后果。
是否为 Web 类漏洞： 是
判断理由：
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | Exploit for command injection vulnerability found in uhttpd binary from TP-Link Tapo c200 IP camera | https://github.com/hacefresko/CVE-2021-4045-PoC | POC详情 |
| 2 | TP-Link Tapo c200 ver <1.1.15 - Remote Code Execution (RCE) | https://github.com/onebytex/CVE-2021-4045 | POC详情 |
| 3 | 🔐 "PWNTAPO: Unveiling Command Injection in TP-Link Tapo C200 Cameras (<= v1.1.16 Build 211209)" 🔓 | https://github.com/B3nj4h/CVE-2021-4045 | POC详情 |
| 4 | 🔐 "PWNTAPO: Unveiling Command Injection in TP-Link Tapo C200 Cameras (<= v1.1.16 Build 211209)" 🔓 | https://github.com/pl4int3xt/CVE-2021-4045 | POC详情 |
| 5 | TP-Link Tapo c200 ver <1.1.15 - Remote Code Execution (RCE) | https://github.com/jeffbezosispogg/CVE-2021-4045 | POC详情 |
| 6 | Exploit for command injection vulnerability found in uhttpd binary from TP-Link Tapo c200 IP camera | https://github.com/hacefresko/CVE-2021-4045 | POC详情 |
| 7 | 🔐 "PWNTAPO: Unveiling Command Injection in TP-Link Tapo C200 Cameras (<= v1.1.16 Build 211209)" 🔓 | https://github.com/0xbinder/CVE-2021-4045 | POC详情 |
| 8 | Sets up a local Tapo C200 using CVE-2021-4045 | https://github.com/DorskFR/tapodate | POC详情 |
| 9 | CVE-2021-4045 CVE-2021-4045 is a Command Injection vulnerability that allows Remote Code Execution in the TP-Link Tapo c200 IP camera. It affects all firmware versions prior to 1.1.16 Build 211209 Rel. 37726N due to insufficient checks on user input in uhttpd, which is one of the main binaries of the device. | https://github.com/234329a423853/CVE-2021-4045 | POC详情 |
暂无评论