CVE-2023-31701

Deeper analysis

TP-Link TL-WPA4530 KIT firmware versions V2 (EU)_170406 and V2 (EU)_161115 contain a command-injection vulnerability (CWE-77) reachable through the _httpRpmPlcDeviceRemove handler. The flaw permits an authenticated user to supply crafted input that is passed directly to a system command, resulting in arbitrary command execution on the device. The issue carries a CVSS 3.1 score of 8.8, reflecting network adjacency, low attack complexity, and low required privileges.

An attacker who has obtained valid credentials, or who can reach the web interface from an adjacent network position, can invoke the affected endpoint to execute operating-system commands. Successful exploitation grants the ability to read or modify device configuration, exfiltrate data, or pivot to other hosts on the local network.

Public references consist of a technical write-up hosted on GitHub that details the request format and reproduction steps; no vendor advisory or firmware patch information is supplied in the available sources. The associated EPSS score has remained flat at 0.1187 since disclosure, indicating no measurable increase in observed exploitation activity.