dbcve.org
OS Command InjectionWeakness · CWE-78

CVE-2023-6437

CRITICAL · 9.8 CVSS v3.1 Published 2024-03-28
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TP-Link TP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD-W9970, Tp-Link TD-W9970v3, TP-Link VX220-G2u, TP-Link VN020-G2u allows authenticated OS Command Injection. This issue affects TP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD-W9970, Tp-Link TD-W9970v3 : through 20240328. Also  the vulnerability continues in the TP-Link VX220-G2u and TP-Link VN020-G2u models due to the products not being produced and supported.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

OS Command Injection vulnerability in multiple TP-Link router models (EX20v AX1800, Archer C5v AC1200, TD-W9970, TD-W9970v3, VX220-G2u, VN020-G2u) allows authenticated attackers to execute arbitrary operating system commands on affected devices through improper neutralization of special elements in input fields.

MitigationApply available vendor firmware patches immediately; for discontinued models (VX220-G2u, VN020-G2u) with no patch path, replace with supported hardware and implement network segmentation to limit exposure.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify your TP-Link router model
    Check the device label or web interface for the exact model number (EX20v AX1800, Archer C5v AC1200, TD-W9970, TD-W9970v3, VX220-G2u, or VN020-G2u)
    Affected if The model matches one of the affected models listed in the CVE
  2. Confirm remote web management is accessible
    Access the router web interface (typically at 192.168.0.1 or 192.168.1.1) from the LAN or WAN interface
    Affected if The web management interface is reachable and accepts authentication
  3. Check if WAN access to management is enabled
    Log into the router web interface and navigate to Advanced > System > Remote Management, or check if port 80/443 is open on the WAN interface using a port scanner
    Affected if Remote management from WAN is enabled, allowing unauthenticated network access to reach the login page
  4. Verify firmware version
    In the router web interface, go to Advanced > System > Firmware Upgrade or Status page to view the installed firmware version
    Affected if The firmware version is unpatched and matches the vulnerable versions for your specific model
  5. Check for command injection accessible features
    After logging into the web interface, examine any diagnostic or configuration input fields (such as ping, traceroute, DDNS settings, or network diagnostics) that accept user input
    Affected if Input fields that could accept operating system commands are present and accessible to authenticated users

You are affected if your TP-Link router model is one of the EX20v AX1800, Archer C5v AC1200, TD-W9970, TD-W9970v3, VX220-G2u, or VN020-G2u and you have an unpatched firmware version with remote web management enabled.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Apply available vendor firmware patches immediately; for discontinued models (VX220-G2u, VN020-G2u) with no patch path, replace with supported hardware and implement network segmentation to limit exposure.

Recommended fix Low confidence
  1. This vulnerability has no available fix as TP-Link has discontinued support for the affected models (VX220-G2u, VN020-G2u).
  2. For the other affected models (EX20v AX1800, Archer C5v AC1200, TD-W9970, TD-W9970v3), no fixed firmware version is specified in the available advisory.
  3. If possible, replace affected devices with currently supported models that receive security updates.
  4. If replacement is not feasible, restrict administrative access to trusted networks only and disable remote management interfaces if not required.
  5. Monitor TP-Link security advisories for any future firmware updates.

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation6.0 h
  • Implementation12.0 h
  • Testing6.0 h
  • Review / QA4.0 h
28.0 hours of engineering $4,980
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $7,968.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2023-6437 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2023-6437 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data