Tomoya Kitagawa

The web management console allows an authenticated user to perform OS command injection, which can lead to arbitrary command execution with root privileges. OS command injection is a flaw where an application passes unsafe user-supplied data to a system shell, allowing the execution of unauthorized operating system commands.

The issue is related to the tdpServer of the TP-Link RE300 V1, which improperly processes its input. This may allow an attacker to cause a denial-of-service (DoS) condition of the product's OneMesh function. The vulnerability is also associated with incorrect clearing or release of resources.

The issue allows an attacker to cause a denial-of-service (DoS) condition and execute arbitrary code via unspecified vectors.

The issue allows remote attackers to execute arbitrary code via a crafted string, specifically through the printfDx function.

The issue is related to a buffer overflow in the CL vsprintf function, which allows remote attackers to execute arbitrary code via a crafted string.