CVE-2022-37860

What it actually does

CVE-2022-37860 is a pre-authentication OS command injection vulnerability in the web configuration interface of TP-Link M7350 V3 devices running firmware version 190531. A remote attacker can send a crafted HTTP request to the device management interface and cause the underlying operating system to execute attacker-supplied commands. Because exploitation requires no credentials, no user interaction, and is network-accessible, successful exploitation can lead to full compromise of the mobile router, including arbitrary command execution, configuration modification, traffic interception, malware deployment, and denial of service.

Why it matters to the business

Compromise of an affected TP-Link M7350 device can disrupt mobile connectivity, expose traffic passing through the router, allow attackers to alter DNS or routing settings, and turn the device into a foothold for botnet activity or further attacks against connected systems. The risk is elevated because public exploit code is available and the EPSS score is high, indicating meaningful real-world exploitation likelihood even though the vulnerability is not currently listed in CISA KEV. Organizations using these devices for remote work, field operations, backup connectivity, or branch access should treat exposed management interfaces as high risk.

How an attack unfolds

An attacker first identifies a TP-Link M7350 V3 device with its web configuration interface reachable over the network, especially from the internet or an untrusted Wi-Fi/client segment. The attacker sends a specially crafted unauthenticated HTTP request containing shell metacharacters or command payloads in a vulnerable input field. The web interface passes that input unsafely to an operating system command, causing the device to execute attacker-controlled commands. After initial command execution, the attacker may download additional tooling, modify device configuration, change DNS or routing behavior, create persistence where possible, join the device to a botnet, capture or redirect traffic, or use the router as a pivot point toward clients connected behind it.

How to fix it

Upgrade affected TP-Link M7350 V3 devices running firmware version 190531 to a vendor-provided fixed firmware release if available. No fixed version was provided in the input, so administrators should check TP-Link support advisories and firmware downloads for the M7350 V3 and apply the latest available firmware. If no fixed firmware is available, remove the web configuration interface from internet exposure, restrict management access to trusted administrative networks only, disable remote administration if supported, require management through a VPN or physically trusted network, and isolate the device from sensitive internal systems. Replace unsupported or unpatchable devices where risk cannot be reduced. After suspected compromise, reset the device to factory defaults, reinstall trusted firmware, change administrative credentials and Wi-Fi keys, review DNS and routing settings, and monitor for recurring outbound malicious traffic.

How to confirm the fix worked

Confirm device inventory for TP-Link M7350 and specifically M7350 V3 devices. Verify firmware versions through the administrative interface or vendor management tooling and ensure devices are no longer running firmware version 190531. Validate that the web configuration interface is not reachable from the public internet or untrusted networks using external scanning and internal network testing. Confirm firewall or access-control rules limit management access to approved administrative sources. After firmware update or mitigation, perform a controlled authenticated and unauthenticated assessment to confirm the vulnerable management interface no longer accepts command-injection payloads and that unexpected outbound connections are not generated. Review configuration for unauthorized DNS, proxy, port-forwarding, routing, or administrator changes.

Typical attack path

1. Scan for TP-Link M7350 devices or exposed web management interfaces.
2. Fingerprint the device model and firmware version, looking for M7350 V3 firmware version 190531 or similar vulnerable builds.
3. Send an unauthenticated crafted HTTP request containing command-injection syntax to the vulnerable web configuration endpoint.
4. Execute a basic command to confirm code execution, such as retrieving system information or initiating an outbound connection.
5. Deploy follow-on payloads using built-in utilities such as shell, BusyBox, wget, curl, tftp, or nc if present.
6. Modify router settings, DNS, firewall, routing, or startup behavior to maintain control or redirect traffic.
7. Use the compromised router for botnet activity, credential interception, network reconnaissance, or attacks against connected systems.

How to detect it

To determine whether exploitation has already occurred, review any available TP-Link device logs, upstream firewall logs, reverse proxy logs, wireless client logs, DHCP records, DNS resolver logs, NetFlow, and packet captures around the device management interface. Look for unauthenticated HTTP requests to the router containing shell metacharacters, URL-encoded command separators, command substitution syntax, or downloader commands. Investigate outbound connections from the router to unfamiliar IP addresses, especially shortly after HTTP requests to the management interface. Check for DNS server changes, altered routing or firewall settings, new port forwards, unexpected reboots, configuration exports, or modified administrator credentials. On networks where device logs are limited, rely on perimeter telemetry: unusual HTTP requests to the router, unexpected outbound TCP/UDP sessions from the router, DNS lookups for suspicious infrastructure, or evidence of botnet behavior such as scanning, high-volume outbound traffic, or repeated connections to command-and-control hosts.

• ;wget
• ;curl
• ;tftp
• |wget
• |curl
• |tftp
• `wget
• `curl
• $(wget
• $(curl
• %3Bwget
• %3Bcurl
• %7Cwget
• %7Ccurl
• /bin/sh
• /bin/busybox
• /tmp/
• /var/tmp/
• chmod +x
• busybox wget
• busybox tftp
• nc -e
• /etc/resolv.conf

What your security team should do

• Immediately identify all TP-Link M7350 and M7350 V3 devices and determine whether firmware version 190531 is present.
• Prioritize remediation for any device whose management interface is reachable from the internet, guest networks, carrier-facing addresses, or other untrusted segments.
• Apply the latest TP-Link firmware for the affected model; if no fixed firmware is available, replace the device or remove it from high-risk use cases.
• Disable remote administration and restrict web management access to trusted administrative networks or VPN-only access.
• Rotate administrative passwords, Wi-Fi keys, and any credentials that may have traversed compromised devices if exploitation is suspected.
• Inspect router configuration for unauthorized DNS servers, routing changes, port forwards, firewall modifications, or unknown administrative users.
• Collect firewall, proxy, DNS, DHCP, NetFlow, and any available device logs for signs of command injection, unusual outbound downloads, or botnet behavior.
• Monitor for exploitation attempts using HTTP request patterns containing shell metacharacters, encoded command separators, and downloader commands targeting router management interfaces.
• Segment mobile routers and connected clients from sensitive internal networks wherever possible.
• Treat repeated exploitation attempts against this device class as high priority because public exploit code is available and the EPSS probability is high.