TP-Link TL-MR6400 Command Injection Vulnerability in Telnet CLI

A command injection vulnerability exists in the Telnet command-line interface of the TP-Link TL-MR6400 router, specifically in version 5.3 prior to 1.9.0 Build 260108. This vulnerability arises from inadequate data sanitization during certain CLI operations, allowing an authenticated attacker with elevated privileges to execute arbitrary system commands. Exploitation of this vulnerability could lead to a complete compromise of the device.

Impact

Exploitation of this vulnerability could result in full device compromise, allowing unauthorized execution of system commands and potentially leading to a loss of confidentiality, integrity, and availability.

Remediation

Users are advised to upgrade to the latest firmware version available on the TP-Link official website for their region. The TL-MR6400 V5.3 firmware version 1.9.0 Build 260108 is the latest version that addresses this vulnerability.