Sign-up

ID

VAR-202209-0693


CVE

CVE-2022-37860


TITLE

TP-LINK Technologies  of  TP-Link M7350  in the firmware  OS  Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2022-016832

DESCRIPTION

The web configuration interface of the TP-Link M7350 V3 with firmware version 190531 is affected by a pre-authentication command injection vulnerability. (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2022-37860 // JVNDB: JVNDB-2022-016832

AFFECTED PRODUCTS

vendor:tp linkmodel:m7350scope:eqversion:190531

Trust: 1.0

vendor:tp linkmodel:tp-link m7350scope: - version: -

Trust: 0.8

vendor:tp linkmodel:tp-link m7350scope:eqversion: -

Trust: 0.8

vendor:tp linkmodel:tp-link m7350scope:eqversion:tp-link m7350 firmware 190531

Trust: 0.8

sources: JVNDB: JVNDB-2022-016832 // NVD: CVE-2022-37860

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2022-37860
value: CRITICAL

Trust: 1.8

CNNVD: CNNVD-202209-727
value: CRITICAL

Trust: 0.6

NVD:
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2022-37860
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-016832 // NVD: CVE-2022-37860 // CNNVD: CNNVD-202209-727

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.0

problemtype:OS Command injection (CWE-78) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-016832 // NVD: CVE-2022-37860

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202209-727

TYPE

command injection

Trust: 0.6

sources: CNNVD: CNNVD-202209-727

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2022-37860

PATCH
title:TP-Link M7350 Fixes for command injection vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=207864
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202209-727

EXTERNAL IDS
db:NVDid:CVE-2022-37860
Trust: 3.2
db:JVNDBid:JVNDB-2022-016832
Trust: 0.8
db:CNNVDid:CNNVD-202209-727
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2022-016832 // 
            
            
            
            NVD: CVE-2022-37860 // 
            
            
            
            CNNVD: CNNVD-202209-727

REFERENCES
url:https://www.tp-link.com/uk/support/download/m7350/v3/#firmware
Trust: 2.4
url:https://www.yuque.com/docs/share/fca60ef9-e5a4-462a-a984-61def4c9b132
Trust: 2.4
url:https://nvd.nist.gov/vuln/detail/cve-2022-37860
Trust: 0.8
url:https://cxsecurity.com/cveshow/cve-2022-37860/
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2022-016832 // 
            
            
            
            NVD: CVE-2022-37860 // 
            
            
            
            CNNVD: CNNVD-202209-727

SOURCES
db:JVNDBid:JVNDB-2022-016832
db:NVDid:CVE-2022-37860
db:CNNVDid:CNNVD-202209-727

LAST UPDATE DATE
2023-12-18T13:17:09.314000+00:00

SOURCES UPDATE DATE
db:JVNDBid:JVNDB-2022-016832date:2023-10-06T08:11:00
db:NVDid:CVE-2022-37860date:2023-08-08T14:21:49.707
db:CNNVDid:CNNVD-202209-727date:2022-09-16T00:00:00

SOURCES RELEASE DATE
db:JVNDBid:JVNDB-2022-016832date:2023-10-06T00:00:00
db:NVDid:CVE-2022-37860date:2022-09-12T18:15:09.057
db:CNNVDid:CNNVD-202209-727date:2022-09-12T00:00:00