CVE-2023-27078

Deeper analysis

A command injection vulnerability tracked as CVE-2023-27078 affects the TP-Link MR3020 router running firmware version 1_150921. The flaw resides in the tftp endpoint and stems from insufficient input validation, allowing an attacker to inject and execute operating-system commands through specially crafted network requests. It carries a CVSS 3.1 base score of 9.8, reflecting network attack vector, low complexity, and no required authentication or user interaction.

An unauthenticated remote attacker can send a malicious request to the tftp endpoint and obtain arbitrary command execution on the device. Successful exploitation grants full control over the router, enabling actions such as altering configuration, intercepting traffic, installing persistent malware, or using the device as a pivot point into attached networks.

Public references consist of a GitHub repository containing technical details and proof-of-concept material; no vendor advisory, firmware patch, or official mitigation guidance is referenced in the available sources. The associated EPSS score remains low, with a current value of 0.0699 and a peak of 0.0704, indicating limited observed exploitation interest since disclosure.