CVE-2017-15630

CVE-2017-15630 describes a critical command injection vulnerability affecting TP-Link WVR, WAR, and ER devices, allowing remote authenticated administrators to execute arbitrary commands through the new-remotesubnet variable in the pptp_client.lua file. With a CVSS score of 7.2 (HIGH), this flaw presents a low-complexity attack vector requiring high privileges but enabling complete compromise of confidentiality, integrity, and availability. While no public exploits like Metasploit or Nuclei modules are available, and there's no evidence of active exploitation or significant community discussion, the vulnerability's severity warrants attention.