CVE-2024-21833

EUVD-2024-19445
Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
ADJACENT_NETWORK
LOW
NONE
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 44%
Affected Products (NVD)
VendorProductVersion
tp-linkarcher_ax3000_firmware
𝑥
< 1.1.2
tp-linkarcher_ax5400_firmware
𝑥
< 1.1.2
tp-linkdeco_x50_firmware
𝑥
< 1.4.1
tp-linkdeco_xe200_firmware
𝑥
< 1.2.5
tp-linkarcher_axe75_firmware
𝑥
< 1.1.9
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
tp-linkarcher_ax3000
1.0 ≤
𝑥
< ax3000(jp)_v1_1.1.2_build 20231115"
ADP
tp-linkarcher_ax5400
𝑥
< ax5400(jp)_v1_1.1.2_build_20231115
ADP
tp-linkarcher_axe75
𝑥
< axe75(jp)_ v1_231115
ADP
tp-linkdeco_x50
𝑥
< deco_x50(jp)_V1_1.4.1_build 20231122"
ADP
tp-linkdeco_xe200
𝑥
< deco_xe200(jp)_v1_1.2.5_build 20231120"
ADP
Common Weakness Enumeration
References
https://jvn.jp/en/vu/JVNVU91401812/
https://www.tp-link.com/jp/support/download/archer-ax3000/#Firmware
https://www.tp-link.com/jp/support/download/archer-ax5400/#Firmware
https://www.tp-link.com/jp/support/download/archer-axe75/#Firmware
https://www.tp-link.com/jp/support/download/deco-x50/v1/#Firmware
https://www.tp-link.com/jp/support/download/deco-xe200/#Firmware
https://jvn.jp/en/vu/JVNVU91401812/
https://www.tp-link.com/jp/support/download/archer-ax3000/#Firmware
https://www.tp-link.com/jp/support/download/archer-ax5400/#Firmware
https://www.tp-link.com/jp/support/download/archer-axe75/#Firmware
https://www.tp-link.com/jp/support/download/deco-x50/v1/#Firmware
https://www.tp-link.com/jp/support/download/deco-xe200/#Firmware