CVE-2020-36178

oal_ipt_addBridgeIsolationRules on TP-Link TL-WR840N 6_EU_0.9.1_4.16 devices allows OS command injection because a raw string entered from the web interface (an IP address field) is used directly for a call to the system library function (for iptables). NOTE: oal_ipt_addBridgeIsolationRules is not the only function that calls util_execSystem.

• CWE-78

• https://github.com/therealunicornsecurity/therealunicornsecurity.github.io/blob/master/_posts/2020-10-11-TPLink.mdExploit, Third Party Advisory
• https://therealunicornsecurity.github.io/TPLink/Exploit, Third Party Advisory
• https://www.tp-link.com/fr/support/download/tl-wr840n/v6/#FirmwareVendor Advisory
• https://github.com/therealunicornsecurity/therealunicornsecurity.github.io/blob/master/_posts/2020-10-11-TPLink.mdExploit, Third Party Advisory
• https://therealunicornsecurity.github.io/TPLink/Exploit, Third Party Advisory
• https://www.tp-link.com/fr/support/download/tl-wr840n/v6/#FirmwareVendor Advisory

Published

Jan 6, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-36172The Advanced Custom Fields plugin before 5.8.12 for WordPres…6.1
• CVE-2020-36173The Ninja Forms plugin before 3.4.28 for WordPress lacks esc…5.3
• CVE-2020-36174The Ninja Forms plugin before 3.4.27.1 for WordPress allows …6.5
• CVE-2020-36175The Ninja Forms plugin before 3.4.27.1 for WordPress allows …5.3
• CVE-2020-36176The iThemes Security (formerly Better WP Security) plugin be…7.5
• CVE-2020-36177RsaPad_PSS in wolfcrypt/src/rsa.c in wolfSSL before 4.6.0 ha…9.8
• CVE-2020-36179FasterXML jackson-databind 2.x before 2.9.10.8 mishandles th…8.1
• CVE-2020-3618NULL exception due to accessing bad pointer while posting ev…7.8
• CVE-2020-36180FasterXML jackson-databind 2.x before 2.9.10.8 mishandles th…8.1
• CVE-2020-36181FasterXML jackson-databind 2.x before 2.9.10.8 mishandles th…8.1
• CVE-2020-36182FasterXML jackson-databind 2.x before 2.9.10.8 mishandles th…8.1
• CVE-2020-36183FasterXML jackson-databind 2.x before 2.9.10.8 mishandles th…8.1