CVE-2022-37860: TP-Link M7350 web interface pre-auth OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, combined with a very high EPSS score and a reference tagged as an exploit, makes this an urgent patch target.

What it is

The web configuration interface of the TP-Link M7350 V3 running firmware 190531 is affected by a pre-authentication OS command injection flaw (CWE-78). Because the flaw is reachable without credentials and over the network, it exposes the device to full compromise by anyone who can reach the management interface.

Impact

An attacker can execute arbitrary OS commands on the device, gaining full control of confidentiality, integrity and availability as reflected in the CVSS 9.8 rating. This can lead to device takeover, credential or configuration theft, and use of the device as a pivot into the local network.

Attack surface

Reached over the network via the device's web configuration interface, per the CVSS vector AV:N/AC:L/PR:N/UI:N, meaning no authentication and no user interaction are required. The record does not state whether the interface must be exposed to the internet or only the LAN, so exposure depends on deployment.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high at 0.80012 (99.6th percentile) and a third-party reference is tagged Exploit, indicating public exploit material exists. No ransomware group usage is documented in the record.

What to do

• Update the M7350 V3 to the latest firmware from the TP-Link download page referenced in the advisory, which is tagged as the patch source.
• If immediate patching is not possible, restrict access to the web configuration interface to trusted management networks only and never expose it to the internet.
• Disable remote/WAN management of the web interface where the product supports it, and place the device behind a firewall that blocks inbound access to its management port.
• Change default administrative credentials and monitor the device for unexpected configuration changes or reboots.
• Segment the device on an isolated network so a compromise cannot be used to pivot to other hosts.

Detection

• Monitor device and network logs for unexpected outbound connections or command execution artifacts originating from the M7350 management interface.
• Alert on HTTP requests to the M7350 web configuration interface from untrusted or external source addresses.
• Baseline and review device configuration changes, new admin accounts, or firmware modifications for signs of tampering.
• Watch for the device being used as a scanning or attack source against other internal hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.