7.2

CVE-2023-42664

Exploit

A post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tp-link ≫ Er7206 Firmware Version1.3.0 Updatebuild_20230322_rel_70591
   Tp-link ≫ Er7206 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.81% 0.731
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
talos-cna@cisco.com 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://talosintelligence.com/vulnerability_reports/TALOS-2023-1856
Third Party Advisory
Exploit
Technical Description