CVE Feed

    Dashboard / CVE / CVE-2023-47209

    CVE-2023-47209

    A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.

    Published:Feb 6, 2024
    Last Modified:Nov 4, 2025
    EPS:Feb 6, 2024
    EPSS Score:0.00781
    CVSS Score:7.2

    Affected Products

    Vendor
    Tp-link
    Product
    Er7206
    Vendor
    Tp-link
    Product
    Er7206 Firmware

    Exploits

    https://talosintelligence.com/vulnerability_reports/TALOS-2023-1854https://talosintelligence.com/vulnerability_reports/TALOS-2023-1854

    Related CVEs

    CVE-2026-19683 (CVSS 6.3) — A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication…
    CVE-2026-19586 (CVSS 9.3) — A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to op…
    CVE-2026-9033 (CVSS 6) — An unauthenticated attacker with network access to the captive portal service of an affected device can termin…
    CVE-2025-9290 (CVSS 6) — An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device …
    CVE-2025-7851 (CVSS 8.7) — An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gate…
    CVE-2025-7850 (CVSS 9.3) — A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada…
    CVE-2025-6542 (CVSS 9.3) — An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.…
    CVE-2025-6541 (CVSS 8.6) — An arbitrary OS command may be executed on the product by the user who can log in to the web management interf…
    CVE-2024-21827 (CVSS 7.2) — A leftover debug code vulnerability exists in the cli_server debug functionality of Tp-Link ER7206 Omada Gigab…
    CVE-2023-43482 (CVSS 7.2) — A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit V…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High