PT-2023-5450 · Tp Link · Deco M4
CVE-2023-40193
·
Publicado
2023-07-19
·
Atualizado
2023-09-11
CVSS v3.1
8.0
Alta
| Vetor | AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Deco M4 firmware versions prior to 'Deco M4(JP) V2 1.5.8 Build 20230619'
Description
The issue allows a network-adjacent authenticated attacker to execute arbitrary OS commands. This is related to the failure to neutralize special elements in the TP-Link Deco M4 mesh system's firmware.
Recommendations
For Deco M4 firmware versions prior to 'Deco M4(JP) V2 1.5.8 Build 20230619', update to 'Deco M4(JP) V2 1.5.8 Build 20230619' or later to resolve the issue. As a temporary workaround, consider restricting access to the device to minimize the risk of exploitation.
Correção
OS Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Deco M4