CVE-2023-43482

TP-Link ER7206 Omada Gigabit VPN Router (1.3.0 build 20230322 Rel.70591) is vulnerable to a command injection in the uhttpd guest-resource flow (CVE-2023-43482). A specially crafted, authenticated HTTP POST to the guest resource endpoint can trigger arbitrary command execution, potentially gainin...

CVE-2023-36498

Summary: CVE-2023-36498 affects the Tp-Link ER7206 Omada Gigabit VPN Router (1.3.0 build 20230322 Rel.70591). Talos’ report details a post-authentication command injection vulnerability in the PPTP client exposed via the web interface (PPTP Client page). A specially crafted authenticated HTTP req...

CVE-2023-47209

A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to...

CVE-2023-47209

CVE-2023-47209 affects the TP-Link ER7206 Omada Gigabit VPN Router (1.3.0, build 20230322 Rel.70591). Talos reports a post-authentication command-injection vulnerability in the ipsec policy workflow triggered by a crafted HTTP request to the uhttpd-backed web UI (VPN → IPsec → IPsec Policy). Expl...

CVE-2023-47617

A post authentication command injection vulnerability exists when configuring the web group member of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP reques...

CVE-2023-47617

Cisco Talos reports a post-authentication command injection in TP-Link ER7206 Omada Router (1.3.0, build 20230322 Rel.70591) via the uhttpd web interface when adding a web group member. The vulnerability stems from unsanitized input used as an argument to a shell command in the websort/web group ...

CVE-2023-46683

CVE-2023-46683 affects TP-Link ER7206 Omada Gigabit VPN Router (1.3.0 build 20230322 Rel.70591). Talos documents a post-authentication command injection in the uhttpd-based web interface when configuring the WireGuard VPN, triggered by crafted HTTP requests after login. Impact is arbitrary comman...

CVE-2023-42664

A post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTT...

CVE-2023-47618

CVE-2023-47618 affects the Tp-Link ER7206 Omada Gigabit VPN Router (1.3.0 build 20230322 Rel.70591). Talos documents a post-authentication command execution vulnerability in the web filtering web UI (webfilter) triggered by adding a web filtering policy, via an HTTP POST to /cgi-bin/luci/;stok=…/...

TP-Link ER7206 Omada Gigabit VPN Router uhttpd Wireguard VPN command injection vulnerability

Talos Vulnerability Report TALOS-2023-1857 TP-Link ER7206 Omada Gigabit VPN Router uhttpd Wireguard VPN command injection vulnerability February 6, 2024 CVE Number CVE-2023-46683 SUMMARY A post authentication command injection vulnerability exists when configuring the wireguard VPN functionality ...

PT-2024-1667 · Tp Link · Tp-Link Er7206 Omada Gigabit Vpn Router

Name of the Vulnerable Software and Affected Versions: Tp-Link ER7206 Omada Gigabit VPN Router version 1.3.0 build 20230322 Rel.70591 Description: A post authentication command injection issue exists when setting up the PPTP global configuration. This can be triggered by a specially crafted HTTP...

PT-2024-1666 · Tp Link · Tp-Link Er7206 Omada Gigabit Vpn Router

Name of the Vulnerable Software and Affected Versions: Tp-Link ER7206 Omada Gigabit VPN Router version 1.3.0 build 20230322 Rel.70591 Description: A post-authentication command injection vulnerability exists in the PPTP client functionality. A specially crafted HTTP request can lead to arbitrary...

TP-Link ER7206 Omada Gigabit VPN Router uhttpd web group command injection vulnerability

Talos Vulnerability Report TALOS-2023-1858 TP-Link ER7206 Omada Gigabit VPN Router uhttpd web group command injection vulnerability February 6, 2024 CVE Number CVE-2023-47617 SUMMARY A post authentication command injection vulnerability exists when configuring the web group member of Tp-Link ER72...

TP-Link ER7206 Omada Gigabit VPN Router uhttpd freeStrategy Command injection Vulnerability

Talos Vulnerability Report TALOS-2023-1850 TP-Link ER7206 Omada Gigabit VPN Router uhttpd freeStrategy Command injection Vulnerability February 6, 2024 CVE Number CVE-2023-43482 SUMMARY A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VP...

TP-Link ER7206 Omada Gigabit VPN Router uhttpd PPTP client Command injection Vulnerability

Talos Vulnerability Report TALOS-2023-1853 TP-Link ER7206 Omada Gigabit VPN Router uhttpd PPTP client Command injection Vulnerability February 6, 2024 CVE Number CVE-2023-36498 SUMMARY A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206...

PT-2024-1663 · Tp Link · Tp-Link Er7206 Omada Gigabit Vpn Router

Name of the Vulnerable Software and Affected Versions: Tp-Link ER7206 Omada Gigabit VPN Router version 1.3.0 build 20230322 Rel.70591 Description: A post authentication command injection issue exists in the GRE policy functionality. This can be exploited by sending a specially crafted HTTP reques...

PT-2024-1783 · Tp Link · Tp-Link Er7206 Omada Gigabit Vpn Router

Name of the Vulnerable Software and Affected Versions: Tp-Link ER7206 Omada Gigabit VPN Router version 1.3.0 build 20230322 Rel.70591 Description: A command execution vulnerability exists in the guest resource functionality. This issue can be triggered by a specially crafted HTTP request, allowin...

(Pwn2Own) TP-Link Omada ER605 DHCPv6 Client Options Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of DHCP options. The issue results from the lack of...

PT-2023-8936 · Tp Link · Tp-Link Omada Er605

Name of the Vulnerable Software and Affected Versions: TP-Link Omada ER605 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605. Authentication is required to exploit this issue. The...

PT-2023-9173

Name of the Vulnerable Software and Affected Versions TP-Link Omada ER605 affected versions not specified Description This issue allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. The flaw exists within the handling of DNS names d...