CVE-2023-6437
CriticalSummary
CVE-2023-6437 describes an improper neutralization of special elements used in OS commands, allowing authenticated users to perform OS command injection on TP-Link EX20v AX1800, Archer C5v AC1200, TD-W9970, TD-W9970v3, and VX220-G2u and VN020-G2u devices.
Risk Assessment
An attacker with access to the system can exploit this vulnerability to execute arbitrary OS commands, potentially leading to device takeover and access to the local network.
Recommendation
It is recommended to update the device firmware to the latest version if available and to restrict access to the devices to trusted users.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TP-Link TP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD-W9970, Tp-Link TD-W9970v3, TP-Link VX220-G2u, TP-Link VN020-G2u allows authenticated OS Command Injection. This issue affects TP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD-W9970, Tp-Link TD-W9970v3 : through 20240328. Also the vulnerability continues in the TP-Link VX220-G2u and TP-Link VN020-G2u models due to the products not being produced and supported.