CVE-2024-21827 Command injection in ER7206 Omada Gigabit VPN Router

High 7.2 Published 25 Jun 2024 Updated 4 Nov 2025

Attackers can execute arbitrary commands on Tp-Link ER7206 routers via crafted network requests exploiting leftover debug code.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-21827?

CVE-2024-21827 is a high-severity command injection vulnerability in Tp-Link ER7206 Omada Gigabit VPN Router, published on 25 Jun 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A leftover debug code vulnerability exists in the cli_server debug functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.4.1 Build 20240117 Rel.57421. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.

Weakness: CWE-489

Which versions are affected by CVE-2024-21827?

It affects 1 product.

Products include Tp-Link Er7206 Firmware.

How do I fix CVE-2024-21827?

No fix has been published for CVE-2024-21827 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-21827 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-21827 exists.

Sources

Also known as GHSA-xg63-7j7m-696f.