CVE:CVE-2020-12111
CNNVD:CNNVD-202005-012
TP-Link NC260和TP-Link NC450都是中国普联（TP-Link）公司的一款网络摄像头。
TP-Link NC260 1.5.2 build 200304版本和NC450 1.5.3 build 200304版本中的ipcamera二进制文件的httpSetEncryptKeyRpm方法存在操作系统命令注入漏洞。远程攻击者可通过发送特制HTTP POST请求到setEncryptKey.fcgi脚本利用该漏洞以root用户身份在系统上执行任意命令。
solution:Upgrade tp-link nc260_firmware to a higher version than 1.0.5:160804,1.0.6:161114,1.4.1:180720,1.5.0:181123,1.5.2:200304,and avoid the version 1.0.5:160804,1.0.6:161114,1.4.1:180720,1.5.0:181123,1.5.2:200304; Upgrade tp-link nc450_firmware to a higher version than 1.0.15:160920,1.1.2:161013,1.3.4:171130,1.5.3:200304,and avoid the version 1.0.15:160920,1.1.2:161013,1.3.4:171130,1.5.3:200304