TP-LINK Products Vulnerable to Arbitrary OS Command Execution via Backup File Restoration

CVE-2024-38471
Currently unrated 🤨

Key Information

Vendor
Tp-link
Status
Archer Ax3000
Archer Axe75
Archer Ax5400
Archer Air R5
Vendor
CVE Published:
4 July 2024

Summary

Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by restoring a crafted backup file. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi.

Affected Version(s)

Archer AX3000 = firmware versions prior to "Archer AX3000(JP)_V1_1.1.3 Build 20240415"

Archer AXE75 = firmware versions prior to "Archer AXE75(JP)_V1_1.2.0 Build 20240320"

Archer AX5400 = firmware versions prior to "Archer AX5400(JP)_V1_1.1.4 Build 20240429"

Timeline

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database
.