PT-2023-28711 · Tp Link · Tplink Tl-Er5120G

Published 2023-09-20 · Updated 2023-09-22 · CVE-2023-43137

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TPLINK TL-ER5120G version 4.0 2.0.0 Build 210817 Rel.80868n

Description The issue is a command injection vulnerability. It occurs when an attacker adds ACL rules after authentication, and the rule name parameter has injection points.

Recommendations For TPLINK TL-ER5120G version 4.0 2.0.0 Build 210817 Rel.80868n, consider disabling the ability to add ACL rules after authentication until a patch is available. Restrict access to the rule name parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2023-43137

Affected Products

Tplink Tl-Er5120G

References · 8

• 🔥❌ https://github.com/7R4C4R/CVE/blob/main/TPLINK-TL-ER5120G/command%20injection/01/command%20injection01.md · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2023-43137 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43137 · Security Note
• https://t.me/cvenotify/58366 · Telegram Post
• https://t.me/cibsecurity/70851 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1704628901572755756 · Twitter Post
• https://t.me/cvenotify/58217 · Telegram Post
• https://twitter.com/CVEnew/status/1704577239382131129 · Twitter Post