CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 0CVE-2024-21833
https://notcve.org/view.php?id=CVE-2024-21833
Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi. Múltiples productos TP-LINK permiten que un atacante no autenticado adyacente a la red con acceso al producto ejecute comandos arbitrarios del sistema operativo. Los productos/versiones afectados son los siguientes: Versiones de firmware de Archer AX3000 anteriores a "Archer AX3000(JP)_V1_1.1.2 Build 20231115", Versiones de firmware de Archer AX5400 anteriores a "Archer AX5400(JP)_V1_1.1.2 Build 20231115", Versiones de firmware de Archer AXE75 anteriores a "Archer AXE75(JP)_V1_231115", versiones de firmware Deco X50 anteriores a "Deco X50(JP)_V1_1.4.1 Build 20231122" y versiones de firmware Deco XE200 anteriores a "Deco XE200(JP)_V1_1.2.5 Build 20231120". • https://jvn.jp/en/vu/JVNVU91401812 https://www.tp-link.com/jp/support/download/archer-ax3000/#Firmware https://www.tp-link.com/jp/support/download/archer-ax5400/#Firmware https://www.tp-link.com/jp/support/download/archer-axe75/#Firmware https://www.tp-link.com/jp/support/download/deco-x50/v1/#Firmware https://www.tp-link.com/jp/support/download/deco-xe200/#Firmware • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.0EPSS: 0%CPEs: 6EXPL: 0CVE-2024-21821
https://notcve.org/view.php?id=CVE-2024-21821
Multiple TP-LINK products allow a network-adjacent authenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commands. Múltiples productos TP-LINK permiten que un atacante autenticado adyacente a la red ejecute comandos arbitrarios del sistema operativo. Los productos/versiones afectados son los siguientes: Versiones de firmware de Archer AX3000 anteriores a "Archer AX3000(JP)_V1_1.1.2 Build 20231115", versiones de firmware de Archer AX5400 anteriores a "Archer AX5400(JP)_V1_1.1.2 Build 20231115" y firmware de Archer AXE75 versiones anteriores a "Archer AXE75(JP)_V1_231115". • https://jvn.jp/en/vu/JVNVU91401812 https://www.tp-link.com/jp/support/download/archer-air-r5/v1/#Firmware https://www.tp-link.com/jp/support/download/archer-ax3000/#Firmware https://www.tp-link.com/jp/support/download/archer-ax5400/#Firmware https://www.tp-link.com/jp/support/download/archer-axe75/#Firmware • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2024-21773
https://notcve.org/view.php?id=CVE-2024-21773
Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commands on the product that has pre-specified target devices and blocked URLs in parental control settings. Múltiples productos TP-LINK permiten que un atacante no autenticado adyacente a la red con acceso al producto ejecute comandos arbitrarios del sistema operativo. Los productos/versiones afectados son los siguientes: Versiones de firmware Archer AX3000 anteriores a "Archer AX3000(JP)_V1_1.1.2 Build 20231115", Versiones de firmware Archer AX5400 anteriores a "Archer AX5400(JP)_V1_1.1.2 Build 20231115", Versiones de firmware Deco X50 anteriores a "Deco X50(JP)_V1_1.4.1 Build 20231122" y versiones de firmware Deco XE200 anteriores a "Deco XE200(JP)_V1_1.2.5 Build 20231120". • https://jvn.jp/en/vu/JVNVU91401812 https://www.tp-link.com/jp/support/download/archer-air-r5/v1/#Firmware https://www.tp-link.com/jp/support/download/archer-ax3000/#Firmware https://www.tp-link.com/jp/support/download/archer-ax5400/#Firmware https://www.tp-link.com/jp/support/download/deco-x50/v1/#Firmware https://www.tp-link.com/jp/support/download/deco-xe200/#Firmware • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •