TP-Link WA850RE Command Injection Vulnerability

A command injection vulnerability has been identified in the TP-Link WA850RE Universal Wi-Fi Range Extender, specifically in versions through WA850RE V2_160527 and WA850RE V3_160922. This vulnerability allows authenticated adjacent attackers to inject arbitrary commands into the httpd server. The injected commands are executed with root privileges, creating a significant security risk. This issue is compounded by an unauthenticated configuration disclosure vulnerability that exposes sensitive information, including admin credentials.

Impact

Exploitation of this vulnerability allows authenticated adjacent attackers to inject and execute arbitrary commands with root privileges on the affected device.

Remediation

Users are advised to update to the latest firmware version. Firmware updates for the WA850RE V2 and V3 are available on the TP-Link official website. Instructions for downloading the firmware are provided on the TP-Link support pages for each version.