Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by restoring a crafted backup file. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi.
References
Configurations
No configuration.
History
13 Mar 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-78 |
21 Nov 2024, 09:26
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://jvn.jp/en/vu/JVNVU99784493/ - | |
| References | () https://www.tp-link.com/jp/support/download/ - | |
| References | () https://www.tp-link.com/jp/support/download/archer-air-r5/v1/#Firmware - | |
| References | () https://www.tp-link.com/jp/support/download/archer-ax3000/#Firmware - | |
| References | () https://www.tp-link.com/jp/support/download/archer-ax5400/#Firmware - | |
| References | () https://www.tp-link.com/jp/support/download/archer-axe5400/#Firmware - | |
| References | () https://www.tp-link.com/jp/support/download/archer-axe75/#Firmware - |
08 Jul 2024, 14:18
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.8 |
04 Jul 2024, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-07-04 01:15
Updated : 2025-03-13 14:15
NVD link : CVE-2024-38471
Mitre link : CVE-2024-38471
CVE.ORG link : CVE-2024-38471
JSON object : View
Products Affected
No product.
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')