CVE-2023-51217 is a high severity (CVSS 8.8) OS command injection in TenghuTOS TWS-200 firmware V4.0-201809201424, in the ping page component. An authenticated remote attacker can run commands. The record names no fix, so check the vendor and limit access to the web interface.
What's affected
The NVD description says an issue in TenghuTOS TWS-200 firmware version V4.0-201809201424 allows a remote attacker to execute arbitrary code via a crafted command on the ping page component. The product is listed as the TWS-200 with that firmware.
The only reference is a researcher write-up on GitHub, which I did not load. The record names no fixed firmware, so contact the vendor for one.
CVSS for this entry is 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
Read the firmware version on the device's status page. V4.0-201809201424 matches the record.
The NVD vector requires a low privilege account. That means your exposure depends on how many accounts exist, whether default credentials remain, and whether the web interface is reachable from untrusted networks.
What to do now
- Identify TWS-200 devices and the firmware they run.
- Contact the vendor for a firmware update that addresses the ping page issue.
- Change default credentials and remove unneeded accounts.
- Block access to the management interface from the internet and untrusted networks.
- Plan to replace the device if no fix is offered.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-78 is OS command injection. Input reaches a shell command without being neutralized, so the attacker can add commands of their own. The fix is to avoid building shell commands from input, or to validate input against a strict allowlist.
CWE-78 is OS command injection. Diagnostic pages such as ping are a classic place for it, because they pass a user-supplied address to a system command. If the input is not neutralized, extra commands ride along.
The NVD vector rates high impact on all three properties with a low privilege requirement. The record does not report exploitation. For embedded devices the practical controls are network placement and account hygiene.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Quick check
Does the attacker need to log in?
The vector says low privileges are required, so yes.
Is a fix available?
The record names none. Ask the vendor.
Sources
Last reviewed: 19 October 2026.
