A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability and gain access to an unrestricted shell.
References
| Link | Resource |
|---|---|
| https://talosintelligence.com/vulnerability_reports/TALOS-2023-1853 | Exploit Technical Description Third Party Advisory |
| https://talosintelligence.com/vulnerability_reports/TALOS-2023-1853 | Exploit Technical Description Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 08:09
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://talosintelligence.com/vulnerability_reports/TALOS-2023-1853 - Exploit, Technical Description, Third Party Advisory |
09 Feb 2024, 02:09
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://talosintelligence.com/vulnerability_reports/TALOS-2023-1853 - Exploit, Technical Description, Third Party Advisory | |
| First Time |
Tp-link
Tp-link er7206 Tp-link er7206 Firmware |
|
| CPE | cpe:2.3:h:tp-link:er7206:-:*:*:*:*:*:*:* cpe:2.3:o:tp-link:er7206_firmware:1.3.0:build_20230322_rel_70591:*:*:*:*:*:* |
06 Feb 2024, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-06 17:15
Updated : 2024-11-21 08:09
NVD link : CVE-2023-36498
Mitre link : CVE-2023-36498
CVE.ORG link : CVE-2023-36498
JSON object : View
Products Affected
tp-link
- er7206
- er7206_firmware
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')