CVE-2017-15637

CVE-2017-15637 describes a command injection vulnerability in TP-Link WVR, WAR, and ER devices, specifically within the pptphellointerval variable in the pptp_server.lua file. This flaw allows remote authenticated administrators to execute arbitrary commands on affected devices. With a CVSS score of 7.2 (HIGH), the vulnerability has a network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability, but requires high privileges. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.