CVE-2024-5227
CVSS v3
7.5
HIGH
EPSS Score
2.1 %
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are only vulnerable if configured to use a PPTP VPN with LDAP authentication. The specific flaw exists within the handling of the username parameter provided to the /usr/bin/pppd endpoint. T
Technical details
- CVSS v3 Vector
- 3.1
- Published
- 2024-05-23
- Last Modified
- 2025-08-06
Frequently asked questions
What is CVE-2024-5227?
TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are only vulnerable if configured to use a PPTP VPN with LDAP authentication. The specific flaw exists within the handling of the username parameter provided to the /usr/bin/pppd endpoint. T
Is CVE-2024-5227 actively exploited?
Active exploitation of CVE-2024-5227 has not been confirmed. The EPSS score is 2.1%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2024-5227?
CVE-2024-5227 has a CVSS v3 base score of 7.5 (HIGH severity), with vector string 3.1.
Is CVE-2024-5227 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2024 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).