PT-2019-4027 · Tp Link · Tp-Link M7350

Published 2019-10-24 · Updated 2019-10-28 · CVE-2019-13653

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n

Description The issue exists due to the lack of neutralization of special elements used in the operating system command in the Port Triggering function of the TP-Link M7350 router's firmware. Exploitation of this issue may allow a remote attacker to execute arbitrary commands.

Recommendations For TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n, consider disabling the Port Triggering function as a temporary workaround until a patch is available. Restrict access to the device to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2019-04588

CVE-2019-13653

Affected Products

Tp-Link M7350

References · 5

• https://osv.dev/vulnerability/CVE-2019-13653 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13653 · Security Note
• https://bdu.fstec.ru/vul/2019-04588 · Security Note
• https://pastebin.com/yAxBFe05 · Note
• https://vuldb.com/?id.144136 · Note