CVSS: 8.0EPSS: 0%CPEs: 4EXPL: 0CVE-2023-31188
https://notcve.org/view.php?id=CVE-2023-31188
Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer C50 firmware versions prior to 'Archer C50(JP)_V3_230505', Archer C55 firmware versions prior to 'Archer C55(JP)_V1_230506', and Archer C20 firmware versions prior to 'Archer C20(JP)_V1_230616'. Múltiples productos TP-LINK permiten que un atacante autenticado adyacente a la red ejecute comandos arbitrarios del sistema operativo. Los productos/versiones afectados son los siguientes: versiones de firmware de Archer C50 anteriores a 'Archer C50(JP)_V3_230505', versiones de firmware de Archer C55 anteriores a 'Archer C55(JP)_V1_230506' y versiones de firmware de Archer C20 anteriores a 'Archer C20(JP) )_V1_230616'. • https://jvn.jp/en/vu/JVNVU99392903 https://www.tp-link.com/jp/support/download/archer-c20/v1/#Firmware https://www.tp-link.com/jp/support/download/archer-c50/v3/#Firmware https://www.tp-link.com/jp/support/download/archer-c55/#Firmware • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-32619
https://notcve.org/view.php?id=CVE-2023-32619
Archer C50 firmware versions prior to 'Archer C50(JP)_V3_230505' and Archer C55 firmware versions prior to 'Archer C55(JP)_V1_230506' use hard-coded credentials to login to the affected device, which may allow a network-adjacent unauthenticated attacker to execute an arbitrary OS command. Las versiones de firmware de Archer C50 anteriores a 'Archer C50(JP)_V3_230505' y las versiones de firmware de Archer C55 anteriores a 'Archer C55(JP)_V1_230506' utilizan credenciales codificadas para iniciar sesión en el dispositivo afectado, lo que puede permitir que un atacante no autenticado adyacente a la red para ejecutar un comando arbitrario del sistema operativo. • https://jvn.jp/en/vu/JVNVU99392903 https://www.tp-link.com/jp/support/download/archer-c50/v3/#Firmware https://www.tp-link.com/jp/support/download/archer-c55/#Firmware • CWE-798: Use of Hard-coded Credentials •