A post authentication command injection vulnerability exists in the GRE policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
References
| Link | Resource |
|---|---|
| https://talosintelligence.com/vulnerability_reports/TALOS-2023-1855 | Exploit Technical Description Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
09 Feb 2024, 02:10
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
|
| CPE | cpe:2.3:h:tp-link:er7206:-:*:*:*:*:*:*:* cpe:2.3:o:tp-link:er7206_firmware:1.3.0:build_20230322_rel_70591:*:*:*:*:*:* |
|
| First Time |
Tp-link
Tp-link er7206 Tp-link er7206 Firmware |
|
| References | () https://talosintelligence.com/vulnerability_reports/TALOS-2023-1855 - Exploit, Technical Description, Third Party Advisory |
06 Feb 2024, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
06 Feb 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-06 17:15
Updated : 2024-02-09 02:10
NVD link : CVE-2023-47167
Mitre link : CVE-2023-47167
CVE.ORG link : CVE-2023-47167
JSON object : View
Products Affected
tp-link
- er7206_firmware
- er7206
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')