CVE-2023-47209

CVE-2023-47209 affects the TP-Link ER7206 Omada Gigabit VPN Router (1.3.0, build 20230322 Rel.70591). Talos reports a post-authentication command-injection vulnerability in the ipsec policy workflow triggered by a crafted HTTP request to the uhttpd-backed web UI (VPN → IPsec → IPsec Policy). Expl...

CVE-2023-47167

Summary (concrete details from sources): CVE-2023-47167 affects the Tp-Link ER7206 Omada Gigabit VPN Router (version 1.3.0 build 20230322 Rel.70591). A post-authentication vulnerability exists in the GRE policy functionality via the device’s web interface (uhttpd). A specially crafted HTTP POST r...

CVE-2023-47209

A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to...

CVE-2023-47167

A post authentication command injection vulnerability exists in the GRE policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to...

CVE-2023-47209

A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to...

CVE-2023-42664

CVE-2023-42664 affects the Tp-Link ER7206 Omada Gigabit VPN Router (1.3.0 build 20230322 Rel.70591). A post-authentication command-injection exists in the PPTP global configuration web page; a specially crafted HTTP POST to the device can trigger arbitrary commands via the vulnerable uhttpd CGI e...

CVE-2023-47617

A post authentication command injection vulnerability exists when configuring the web group member of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP reques...

CVE-2023-46683

A post authentication command injection vulnerability exists when configuring the wireguard VPN functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection . An attacker can make an authenticated...

CVE-2023-47617

A post authentication command injection vulnerability exists when configuring the web group member of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP reques...

CVE-2023-47617

Cisco Talos reports a post-authentication command injection in TP-Link ER7206 Omada Router (1.3.0, build 20230322 Rel.70591) via the uhttpd web interface when adding a web group member. The vulnerability stems from unsanitized input used as an argument to a shell command in the websort/web group ...

CVE-2023-42664

A post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTT...

CVE-2023-46683

CVE-2023-46683 affects TP-Link ER7206 Omada Gigabit VPN Router (1.3.0 build 20230322 Rel.70591). Talos documents a post-authentication command injection in the uhttpd-based web interface when configuring the WireGuard VPN, triggered by crafted HTTP requests after login. Impact is arbitrary comman...

CVE-2023-42664

A post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTT...

CVE-2023-47618

A post authentication command execution vulnerability exists in the web filtering functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request t...

CVE-2023-47618

A post authentication command execution vulnerability exists in the web filtering functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request t...

CVE-2023-47618

CVE-2023-47618 affects the Tp-Link ER7206 Omada Gigabit VPN Router (1.3.0 build 20230322 Rel.70591). Talos documents a post-authentication command execution vulnerability in the web filtering web UI (webfilter) triggered by adding a web filtering policy, via an HTTP POST to /cgi-bin/luci/;stok=…/...

TP-LINK ER7206 Operating System Command Injection Vulnerability

The TP-LINK ER7206 is a multifunctional Gigabit router from China P&L TP-LINK. An operating system command injection vulnerability exists in the TP-LINK ER7206 version 1.3.0 build 20230322 Rel.70591, which stems from a specially crafted HTTP request that could lead to arbitrary command execution...

TP-LINK ER7206 操作系统命令注入漏洞

The TP-LINK ER7206 is a multi-function Gigabit router from China P&L TP-LINK. An operating system command injection vulnerability exists in the TP-LINK ER7206 version 1.3.0 build 20230322 Rel.70591, which stems from a specially crafted HTTP request that could lead to arbitrary command injection. ...

TP-LINK ER7206 操作系统命令注入漏洞

The TP-LINK ER7206 is a multi-function Gigabit router from China P&L TP-LINK. An operating system command injection vulnerability exists in the TP-LINK ER7206 version 1.3.0 build 20230322 Rel.70591, which stems from a specially crafted HTTP request that could lead to arbitrary command injection. ...

TP-Link ER7206 Omada Gigabit VPN Router uhttpd PPTP client Command injection Vulnerability

Talos Vulnerability Report TALOS-2023-1853 TP-Link ER7206 Omada Gigabit VPN Router uhttpd PPTP client Command injection Vulnerability February 6, 2024 CVE Number CVE-2023-36498 SUMMARY A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206...