CVE-2020-12109

Name: CVE-2020-12109
Creator: NVD / NIST
Published: 2020-05-04T16:15:12.087+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.8/10EPSS 74.34%

Last modified Jun 17, 2026

CVE-2020-12109 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Certain TP-Link devices allow Command Injection. This affects NC200 2.1.9 build 200225, NC210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 200304, NC250 1.3.0 build 200304, NC260 1.5.2 build 200304, and NC450 1.5.3 build 200304.. EPSS estimates a 74.34% chance of exploitation in the next 30 days.

Description

Certain TP-Link devices allow Command Injection. This affects NC200 2.1.9 build 200225, NC210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 200304, NC250 1.3.0 build 200304, NC260 1.5.2 build 200304, and NC450 1.5.3 build 200304.

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

74.34%

99.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-78

Affected Software

Vendor	Product	Versions	Update
Tp-Link	Nc200 Firmware	2.1.6	160108 B
Tp-Link	Nc200 Firmware	2.1.9	200225
Tp-Link	Nc210 Firmware	1.0.3	160229
Tp-Link	Nc210 Firmware	1.0.4	160412
Tp-Link	Nc210 Firmware	1.0.9	200304
Tp-Link	Nc220 Firmware	1.2.0	170516
Tp-Link	Nc220 Firmware	1.3.0	180105
Tp-Link	Nc230 Firmware	1.0.3	160108
Tp-Link	Nc230 Firmware	1.2.1	170515
Tp-Link	Nc230 Firmware	1.3.0	200304
Tp-Link	Nc250 Firmware	1.0.8	160108
Tp-Link	Nc250 Firmware	1.0.10	160321
Tp-Link	Nc250 Firmware	1.2.1	170515
Tp-Link	Nc250 Firmware	1.3.0	200304
Tp-Link	Nc260 Firmware	1.0.5	160804
Tp-Link	Nc260 Firmware	1.0.6	161114
Tp-Link	Nc260 Firmware	1.4.1	180720
Tp-Link	Nc260 Firmware	1.5.0	181123
Tp-Link	Nc260 Firmware	1.5.2	200304
Tp-Link	Nc450 Firmware	1.0.15	160920
Tp-Link	Nc450 Firmware	1.1.2	161013
Tp-Link	Nc450 Firmware	1.3.4	171130
Tp-Link	Nc450 Firmware	1.5.3	200304

References

http://packetstormsecurity.com/files/157531/TP-LINK-Cloud-Cameras-NCXXX-Bonjour-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/159222/TP-Link-Cloud-Cameras-NCXXX-Bonjour-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://seclists.org/fulldisclosure/2020/May/2Exploit, Mailing List, Third Party Advisory
https://www.tp-link.com/us/securityVendor Advisory
http://packetstormsecurity.com/files/157531/TP-LINK-Cloud-Cameras-NCXXX-Bonjour-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/159222/TP-Link-Cloud-Cameras-NCXXX-Bonjour-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://seclists.org/fulldisclosure/2020/May/2Exploit, Mailing List, Third Party Advisory
https://www.tp-link.com/us/securityVendor Advisory

Timeline

Published: May 4, 2020
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2020-12109?

How severe is CVE-2020-12109?

CVE-2020-12109 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 74.34% probability of exploitation in the next 30 days.

How do I fix CVE-2020-12109?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-12109?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST