// For flags

CVE-2024-21833

 

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi.

Múltiples productos TP-LINK permiten que un atacante no autenticado adyacente a la red con acceso al producto ejecute comandos arbitrarios del sistema operativo. Los productos/versiones afectados son los siguientes: Versiones de firmware de Archer AX3000 anteriores a "Archer AX3000(JP)_V1_1.1.2 Build 20231115", Versiones de firmware de Archer AX5400 anteriores a "Archer AX5400(JP)_V1_1.1.2 Build 20231115", Versiones de firmware de Archer AXE75 anteriores a "Archer AXE75(JP)_V1_231115", versiones de firmware Deco X50 anteriores a "Deco X50(JP)_V1_1.4.1 Build 20231122" y versiones de firmware Deco XE200 anteriores a "Deco XE200(JP)_V1_1.2.5 Build 20231120".

*Credits: N/A
CVSS Scores
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-01-04 CVE Reserved
  • 2024-01-10 CVE Published
  • 2024-11-06 CVE Updated
  • 2024-11-16 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Tp-link
Search vendor "Tp-link"
 Archer Ax3000 Firmware
Search vendor "Tp-link" for product "Archer Ax3000 Firmware"
 < 1.1.2
Search vendor "Tp-link" for product "Archer Ax3000 Firmware" and version " < 1.1.2"
-
Affected
in Tp-link
Search vendor "Tp-link"
 Archer Ax3000
Search vendor "Tp-link" for product "Archer Ax3000"
 1.0
Search vendor "Tp-link" for product "Archer Ax3000" and version "1.0"
-
Safe
Tp-link
Search vendor "Tp-link"
 Archer Ax5400 Firmware
Search vendor "Tp-link" for product "Archer Ax5400 Firmware"
 < 1.1.2
Search vendor "Tp-link" for product "Archer Ax5400 Firmware" and version " < 1.1.2"
-
Affected
in Tp-link
Search vendor "Tp-link"
 Archer Ax5400
Search vendor "Tp-link" for product "Archer Ax5400"
 1.0
Search vendor "Tp-link" for product "Archer Ax5400" and version "1.0"
-
Safe
Tp-link
Search vendor "Tp-link"
 Deco X50 Firmware
Search vendor "Tp-link" for product "Deco X50 Firmware"
 < 1.4.1
Search vendor "Tp-link" for product "Deco X50 Firmware" and version " < 1.4.1"
-
Affected
in Tp-link
Search vendor "Tp-link"
 Deco X50
Search vendor "Tp-link" for product "Deco X50"
 1.0
Search vendor "Tp-link" for product "Deco X50" and version "1.0"
-
Safe
Tp-link
Search vendor "Tp-link"
 Deco Xe200 Firmware
Search vendor "Tp-link" for product "Deco Xe200 Firmware"
 < 1.2.5
Search vendor "Tp-link" for product "Deco Xe200 Firmware" and version " < 1.2.5"
-
Affected
in Tp-link
Search vendor "Tp-link"
 Deco Xe200
Search vendor "Tp-link" for product "Deco Xe200"
 1.0
Search vendor "Tp-link" for product "Deco Xe200" and version "1.0"
-
Safe
Tp-link
Search vendor "Tp-link"
 Archer Axe75 Firmware
Search vendor "Tp-link" for product "Archer Axe75 Firmware"
 < 1.1.9
Search vendor "Tp-link" for product "Archer Axe75 Firmware" and version " < 1.1.9"
-
Affected
in Tp-link
Search vendor "Tp-link"
 Archer Axe75
Search vendor "Tp-link" for product "Archer Axe75"
 1.0
Search vendor "Tp-link" for product "Archer Axe75" and version "1.0"
-
Safe