CVE-2024-5227: fallo de gravedad alta en TP-Link Omada ER605
TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.7%
TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are only vulnerable if configured to use a PPTP VPN with LDAP authentication.
The specific flaw exists within the handling of the username parameter provided to the /usr/bin/pppd endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22446.
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
TP-Link · Omada ER605CVEs relacionadas — TP-Link Omada ER605
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-1180MEDIUMTP-Link Omada ER605 Access Control Command Injection Remote Code Execution VulnerabilityEPSS 1.0%CVE-2024-1179HIGHTP-Link Omada ER605 DHCPv6 Client Options Stack-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-5243HIGHTP-Link Omada ER605 Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.8%CVE-2024-5242HIGHTP-Link Omada ER605 Stack-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.8%CVE-2024-5228HIGHTP-Link Omada ER605 Comexe DDNS Response Handling Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.5%CVE-2024-5244MEDIUMTP-Link Omada ER605 Reliance on Security Through Obscurity VulnerabilityEPSS 0.4%