CVE-2022-37860

Deeper analysis

The vulnerability is a pre-authentication command injection flaw, tracked as CVE-2022-37860 and assigned CWE-78, that affects the web configuration interface of the TP-Link M7350 V3 running firmware version 190531. It carries a CVSS 3.1 base score of 9.8, reflecting network-accessible exploitation with no required credentials or user interaction and full impact on confidentiality, integrity, and availability.

An unauthenticated attacker with network reachability to the device's web interface can inject and execute arbitrary operating-system commands. Successful exploitation grants the attacker complete control over the affected mobile hotspot, including the ability to read or modify data, alter device behavior, or disrupt service.

The vendor references point to updated firmware images hosted on the TP-Link support site for the M7350 V3, indicating that applying a newer firmware release is the intended remediation path. The accompanying disclosure document provides additional technical detail on the issue.

EPSS for the CVE currently stands at 0.4175 with an identical recorded peak, indicating sustained but not sharply increasing exploitation interest since publication.