CVE-2024-21827: er7206 — Exploit

Description

A leftover debug code vulnerability exists in the cli_server debug functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.4.1 Build 20240117 Rel.57421. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.

Is your site exposed to CVE-2024-21827?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.2

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-489 CWE-489

Affected Products

Vendor	Product	Versions
tp-link	er7206_firmware	All
tp-link	er7206	All

References

Exploits

https://talosintelligence.com/vulnerability_reports/TALOS-2024-1947 https://talosintelligence.com/vulnerability_reports/TALOS-2024-1947

Other References

https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1947

Frequently Asked Questions

What is CVE-2024-21827? +

A leftover debug code vulnerability exists in the cli_server debug functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.4.1 Build 20240117 Rel.57421. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability. It has a CVSS v3.1 base score of 7.2 (HIGH).

How severe is CVE-2024-21827? +

CVE-2024-21827 has a CVSS v3.1 score of 7.2 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-21827? +

CVE-2024-21827 affects products from tp-link, specifically: er7206, er7206_firmware. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-21827? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-4106

An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable …

CVE-2025-15017

A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface. An attacker with …

CVE-2024-32047 9.8

Hard-coded credentials for the CyberPower PowerPanel test server can be found in the production code. This might result in an …

CVE-2024-46873 9.8

Multiple SHARP routers leave the hidden debug function enabled. An arbitrary OS command may be executed with the root privilege …

CVE-2024-9643 9.8

The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to authentication bypass due to hard-coded credentials in the administrative web …

CVE-2024-9644 9.8

The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to an authentication bypass vulnerability in the administrative web server. Authentication …

CVE-2024-21827