PT-2023-5450 · Tp Link · Deco M4

Published 2023-07-19 · Updated 2023-09-11 · CVE-2023-40193

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Deco M4 firmware versions prior to 'Deco M4(JP) V2 1.5.8 Build 20230619'

Description The issue allows a network-adjacent authenticated attacker to execute arbitrary OS commands. This is related to the failure to neutralize special elements in the TP-Link Deco M4 mesh system's firmware.

Recommendations For Deco M4 firmware versions prior to 'Deco M4(JP) V2 1.5.8 Build 20230619', update to 'Deco M4(JP) V2 1.5.8 Build 20230619' or later to resolve the issue. As a temporary workaround, consider restricting access to the device to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-06080

CVE-2023-40193

Affected Products

Deco M4

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-40193 · Security Note
• https://bdu.fstec.ru/vul/2023-06080 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40193 · Vendor Advisory
• https://jvn.jp/en/vu/JVNVU99392903 · Note
• https://tp-link.com/jp/support/download/deco-m4/v2/#Firmware · Note
• https://t.me/cvenotify/57939 · Telegram Post
• https://vuldb.com/ru/?id.238990 · Note
• https://twitter.com/VulmonFeeds/status/1699402428347490528 · Twitter Post
• https://t.me/cibsecurity/69988 · Telegram Post
• https://twitter.com/CVEnew/status/1699356407081136396 · Twitter Post