PT-2025-29544 · Samsung · Samsung Wlan Ap Wea453E

Omri Inbar · Published 2025-07-15 · Updated 2025-07-15 · CVE-2025-34068

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Samsung WLAN AP WEA453e versions prior to 5.2.4.T1

Description An unauthenticated remote command execution issue exists due to improper input validation in the “Tech Support” diagnostic functionality. The command1 and command2 POST or GET parameters accept arbitrary shell commands that are executed with root privileges. An attacker can exploit this by crafting a request to inject shell commands, create output files in writable directories, and then access their contents via the download endpoint, leading to complete device compromise without authentication.

Recommendations Update to version 5.2.4.T1 or later.

Exploit

Fix

Missing Authentication

OS Command Injection

RCE

Weakness Enumeration

CWE-306

CWE-78

CWE-20

Related Identifiers

CVE-2025-34068

Affected Products

Samsung Wlan Ap Wea453E

References · 9

• 🔥 https://omriinbar.medium.com/samsung-wlan-ap-wea453e-vulnerabilities-7aa4a57d4dba · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34068 · Security Note
• https://vulncheck.com/advisories/samsung-wlan-ap-wea453e-unauthenticated-rce · Note
• https://s4e.io/tools/samsung-wlan-ap-remote-code-execution · Note
• https://fortiguard.fortinet.com/encyclopedia/ips/57323 · Note
• https://twitter.com/CVEnew/status/1945118954202230975 · Twitter Post
• https://samsung.com/us/business/support/owners/product/400-series-wea453 · Note
• https://vulncheck/advisories/samsung-wlan-ap-wea453e-unauthenticated-rce · Note
• https://twitter.com/VulmonFeeds/status/1945143896192831801 · Twitter Post