CVSS: 4.6EPSS: 0%CPEs: 8EXPL: 2CVE-2023-49515
https://notcve.org/view.php?id=CVE-2023-49515
Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware v.1.3.4 and fixed in v.1.3.11 allows a physically proximate attacker to obtain sensitive information via a connection to the UART pin components. La vulnerabilidad de permisos inseguros en TP Link TC70 y C200 WIFI Camera v.3 firmware v.1.3.4 y corregida en v.1.3.11 permite a un atacante físicamente cercano obtener información confidencial a través de una conexión a los componentes del pin UART. • https://github.com/VineethKumarM/TAPO-TC70-Unauthorized-root-access-using-UART https://github.com/VineethKumarM/TAPO-TC70-Unauthorized-root-access-using-UART/tree/master • CWE-922: Insecure Storage of Sensitive Information •
CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 0CVE-2024-21833
https://notcve.org/view.php?id=CVE-2024-21833
Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi. Múltiples productos TP-LINK permiten que un atacante no autenticado adyacente a la red con acceso al producto ejecute comandos arbitrarios del sistema operativo. Los productos/versiones afectados son los siguientes: Versiones de firmware de Archer AX3000 anteriores a "Archer AX3000(JP)_V1_1.1.2 Build 20231115", Versiones de firmware de Archer AX5400 anteriores a "Archer AX5400(JP)_V1_1.1.2 Build 20231115", Versiones de firmware de Archer AXE75 anteriores a "Archer AXE75(JP)_V1_231115", versiones de firmware Deco X50 anteriores a "Deco X50(JP)_V1_1.4.1 Build 20231122" y versiones de firmware Deco XE200 anteriores a "Deco XE200(JP)_V1_1.2.5 Build 20231120". • https://jvn.jp/en/vu/JVNVU91401812 https://www.tp-link.com/jp/support/download/archer-ax3000/#Firmware https://www.tp-link.com/jp/support/download/archer-ax5400/#Firmware https://www.tp-link.com/jp/support/download/archer-axe75/#Firmware https://www.tp-link.com/jp/support/download/deco-x50/v1/#Firmware https://www.tp-link.com/jp/support/download/deco-xe200/#Firmware • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.0EPSS: 0%CPEs: 6EXPL: 0CVE-2024-21821
https://notcve.org/view.php?id=CVE-2024-21821
Multiple TP-LINK products allow a network-adjacent authenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commands. Múltiples productos TP-LINK permiten que un atacante autenticado adyacente a la red ejecute comandos arbitrarios del sistema operativo. Los productos/versiones afectados son los siguientes: Versiones de firmware de Archer AX3000 anteriores a "Archer AX3000(JP)_V1_1.1.2 Build 20231115", versiones de firmware de Archer AX5400 anteriores a "Archer AX5400(JP)_V1_1.1.2 Build 20231115" y firmware de Archer AXE75 versiones anteriores a "Archer AXE75(JP)_V1_231115". • https://jvn.jp/en/vu/JVNVU91401812 https://www.tp-link.com/jp/support/download/archer-air-r5/v1/#Firmware https://www.tp-link.com/jp/support/download/archer-ax3000/#Firmware https://www.tp-link.com/jp/support/download/archer-ax5400/#Firmware https://www.tp-link.com/jp/support/download/archer-axe75/#Firmware • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2024-21773
https://notcve.org/view.php?id=CVE-2024-21773
Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commands on the product that has pre-specified target devices and blocked URLs in parental control settings. Múltiples productos TP-LINK permiten que un atacante no autenticado adyacente a la red con acceso al producto ejecute comandos arbitrarios del sistema operativo. Los productos/versiones afectados son los siguientes: Versiones de firmware Archer AX3000 anteriores a "Archer AX3000(JP)_V1_1.1.2 Build 20231115", Versiones de firmware Archer AX5400 anteriores a "Archer AX5400(JP)_V1_1.1.2 Build 20231115", Versiones de firmware Deco X50 anteriores a "Deco X50(JP)_V1_1.4.1 Build 20231122" y versiones de firmware Deco XE200 anteriores a "Deco XE200(JP)_V1_1.2.5 Build 20231120". • https://jvn.jp/en/vu/JVNVU91401812 https://www.tp-link.com/jp/support/download/archer-air-r5/v1/#Firmware https://www.tp-link.com/jp/support/download/archer-ax3000/#Firmware https://www.tp-link.com/jp/support/download/archer-ax5400/#Firmware https://www.tp-link.com/jp/support/download/deco-x50/v1/#Firmware https://www.tp-link.com/jp/support/download/deco-xe200/#Firmware • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2023-27098
https://notcve.org/view.php?id=CVE-2023-27098
TP-Link Tapo APK up to v2.12.703 uses hardcoded credentials for access to the login panel. TP-Link Tapo APK hasta v2.12.703 utiliza credenciales codificadas para acceder al panel de inicio de sesión. • http://tp-lin.com http://tp-link.com https://github.com/c0d3x27/CVEs/tree/main/CVE-2023-27098 https://www.tp-link.com/support/contact-technical-support/#LiveChat-Support • CWE-312: Cleartext Storage of Sensitive Information •