OS Command Execution Vulnerability in TP-LINK Archer Products
CVE-2023-40357

8HIGH

Key Information:

Vendor

Tp-link
Status
Archer Ax50
Archer A10
Archer Ax10
Archer Ax11000
Vendor
CVE Published:
6 September 2023

What is CVE-2023-40357?

Multiple TP-LINK Archer routers have a vulnerability that allows network-adjacent authenticated attackers to execute arbitrary OS commands. This affects various firmware versions across the Archer AX50, A10, AX10, and AX11000 models, highlighting the importance of keeping devices updated to mitigate potential security threats.

Affected Version(s)

Archer A10 firmware versions prior to 'Archer A10(JP)_V2_230504'

Archer AX10 firmware versions prior to 'Archer AX10(JP)_V1.2_230508'

Archer AX11000 firmware versions prior to 'Archer AX11000(JP)_V1_230523'

References

https://www.tp-link.com/jp/support/download/archer-ax50/#...
https://www.tp-link.com/jp/support/download/archer-a10/#F...
https://www.tp-link.com/jp/support/download/archer-ax10/#...

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.