Security Resilience

CVE-2023-43137

RCE in Tp-Link Tl-Er5120G Firmware 2.0.0

Public PoCRCECommand Injection
Published
20 September 2023
Modified
21 November 2024
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.024 84th percentile
Risk Priority 68 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-43137 is a high-severity Command Injection (CWE-77) vulnerability in Tp-Link Tl-Er5120G Firmware. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 16% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability Data

TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds ACL rules after authentication, and the rule name parameter has injection points.

CWE(s)
CWE-77

Related Threats

CVEs Like This One

CVE-2023-43138Same product: Tp-Link Tl-Er5120G
CVE-2023-43135Same product: Tp-Link Tl-Er5120G
CVE-2023-1389Same vendor: Tp-Link
CVE-2023-27078Same vendor: Tp-Link
CVE-2025-15607Same vendor: Tp-Link
CVE-2023-33538Same vendor: Tp-Link
CVE-2021-4045Same vendor: Tp-Link
CVE-2023-31700Same vendor: Tp-Link
CVE-2025-14756Same vendor: Tp-Link
CVE-2023-27836Same vendor: Tp-Link

Affected Assets

tp-link
tl-er5120g firmware
2.0.0

Mitigating Controls

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.25 Secure development life cycle partial match
blocks

A.8.25 mandates secure SDLC practices including secure coding guidelines, security requirements, checkpoints, testing (scans/penetration), and developer training that reduce command injection defects, but leaves a minority slice (e.g. incomplete implementation of those practices, outsourced development without full assurance, or post-SDLC changes) where the weakness can still arise and be exploitable.

A.8.26 Application security requirements partial match
blocks

Application security requirements explicitly call for controls against injection flaws including command injection.

A.8.27 Secure system architecture and engineering principles partial match
blocks

A.8.27 mandates security-by-design principles (e.g. distrust external input, secure session control, data validation/sanitization, least privilege) and design reviews that can stop command injection from being introduced, but this is only a minority slice of CWE-77 because the weakness can still arise in code that bypasses those principles, in non-reviewed components, or in runtime injection vectors the architecture review does not reach.

A.8.28 Secure coding partial match
prevents

Secure coding standards require proper escaping and parameterization of commands, directly eliminating CWE-77.

A.8.29 Security testing in development and acceptance partial match
finds

Security testing in development catches command-injection vulnerabilities before release.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-77, a class-level weakness, and none of its children carries one either.

References