OS Command Injection in TP-Link Routers

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TP-Link TP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD-W9970, Tp-Link TD-W9970v3, TP-Link VX220-G2u, TP-Link VN020-G2u allows authenticated OS Command Injection. This issue affects TP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD-W9970, Tp-Link TD-W9970v3: through 20240328. Also, the vulnerability continues in the TP-Link VX220-G2u and TP-Link VN020-G2u models due to the products not being produced and supported.

• TP-Link EX20v AX1800, Archer C5v AC1200, TD-W9970, and TD-W9970v3: recorded as affected through the custom version boundary 20240328, with the CNA affected data specifying versions from 0 through 20240328. The description states the scope as “through 20240328”.
• TP-Link VX220-G2u and VN020-G2u: the vulnerability continues because these products are no longer produced and supported.
• The record does not provide a specific fixed firmware release, does not identify a confirmed patched build, and does not establish that later or parallel release branches are unaffected.

This is a CWE-78 weakness caused by improper neutralization of special elements in data passed to an operating-system command. The CNA description confirms that TP-Link EX20v AX1800, Archer C5v AC1200, TD-W9970, TD-W9970v3, VX220-G2u, and VN020-G2u expose functionality that permits OS command injection. The description calls the issue authenticated, while the associated scoring vector models no required privileges, so the actual authentication precondition is unresolved by the available evidence. Publicly available details do not identify the endpoint, parameter, command-processing component, or exploit syntax, so no further attack path should be inferred.

The vulnerability is modeled as network-reachable, low-complexity, and not requiring user interaction. However, the CNA description says authentication is required, while the scoring vector models no required privileges; this condition should be verified for each deployment. The CISA enrichment records exploitation as none at the time of that assessment, but this does not establish that exploitation is absent now or cannot emerge later. The record does not provide enough public detail to confirm a public exploit, campaign, victim, or specific indicator of compromise.

The flaw may provide operating-system command execution on an affected TP-Link device. With that capability, an attacker could change device state or configuration, access data processed by the device, and disrupt network operations. The record models high confidentiality, integrity, and availability impact, but the practical outcome depends on the privileges of the vulnerable process and the device's position in the network. The record does not confirm privilege-boundary bypass or propagation to other systems. The authentication condition remains uncertain because the CNA description and scoring vector are inconsistent.

• An attacker may gain command execution on an affected device if the vulnerable functionality is reachable and the deployment's actual access preconditions are met.
• Command execution could allow configuration changes, network-service disruption, or access to data handled by the device.
• A compromised network device could become a foothold for further activity in the surrounding environment, but the record does not confirm a specific intrusion scenario.
• VX220-G2u and VN020-G2u are described as no longer produced or supported, reducing the likelihood of receiving an official fix or vendor assistance.

1. Prioritize replacing or isolating TP-Link VX220-G2u and VN020-G2u because the record states that these models are no longer produced or supported and that the vulnerability continues in them.
2. For EX20v AX1800, Archer C5v AC1200, TD-W9970, and TD-W9970v3, verify the running firmware against TP-Link's official support information and apply an update if one is available for the exact model and branch. This record does not specify a fixed release.
3. If replacement or updating is not immediately possible, reduce exposure of management interfaces to untrusted networks, restrict administrative access, and monitor for unusual logins or configuration changes. These are general mitigations, not vendor-confirmed remediation steps.
4. After updating or replacing devices, recheck the model, firmware, management configuration, and peer devices to ensure that no affected equipment remains.

1. Inventory deployed TP-Link devices and identify the exact model, firmware, or custom version branch for EX20v AX1800, Archer C5v AC1200, TD-W9970, TD-W9970v3, VX220-G2u, and VN020-G2u.
2. Check the support status of each device, especially VX220-G2u and VN020-G2u, because the record states that these models are no longer produced or supported.
3. Review management, authentication, and network-access logs for unusual administrative sessions, unexpected configuration changes, or activity originating from the management interface. This is precautionary monitoring, not a confirmed indicator specific to this vulnerability.
4. Do not treat the absence of suspicious log events as proof of safety because the record does not provide a named endpoint, log pattern, or IOC.