CVE-2023-6437 Authenticated RCE
Authenticated attackers can execute arbitrary OS commands on vulnerable TP-Link routers, potentially compromising the device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-6437?
CVE-2023-6437 is a critical command injection vulnerability in TP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD-W9970, Tp-Link TD-W9970v3, TP-Link VX220-G2u, TP-Link VN020-G2u, published on 28 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TP-Link TP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD-W9970, Tp-Link TD-W9970v3, TP-Link VX220-G2u, TP-Link VN020-G2u allows authenticated OS Command Injection.
This issue affects TP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD-W9970, Tp-Link TD-W9970v3 : through 20240328. Also the vulnerability continues in the TP-Link VX220-G2u and TP-Link VN020-G2u models due to the products not being produced and supported.
Weakness: CWE-78
Which versions are affected by CVE-2023-6437?
How do I fix CVE-2023-6437?
No fix has been published for CVE-2023-6437 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-6437 being exploited?
There is no known exploitation of CVE-2023-6437 in the wild and no public exploit code.
Sources
Also known as GHSA-q3f6-347p-3qc9.