A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability and gain access to an unrestricted shell.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Tp-Link | ER7206 Omada Gigabit VPN Router | affected |
|
Configuration 1 [-]
| AND |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-40447 | A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability and gain access to an unrestricted shell. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 04 Nov 2025 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: talos
Published:
Updated: 2025-11-04T18:15:13.723Z
Reserved: 2023-11-07T22:57:30.277Z
Link: CVE-2023-36498
Vulnrichment
Updated: 2024-08-02T16:45:57.148Z
NVD
Status : Modified
Published: 2024-02-06T17:15:08.527
Modified: 2025-11-04T19:15:46.107
Link: CVE-2023-36498
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses