Post-Authentication Command Injection Vulnerability Affects Tp-Link ER7206 Omada Gigabit VPN Router

CVE-2023-36498

7.2HIGH

Key Information

Vendor
Tp-Link
Status
ER7206 Omada Gigabit VPN Router
Vendor
CVE Published:
6 February 2024

Summary

A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability and gain access to an unrestricted shell.

Affected Version(s)

ER7206 Omada Gigabit VPN Router = 1.3.0 build 20230322 Rel.70591

Refferences

https://talosintelligence.com/vulnerability_reports/TALOS...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database

Credit

Discovered by the Vulnerability Discovery and Research team of Cisco Talos.
.