6.8

CVE-2024-38471

Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by restoring a crafted backup file. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi.
Daten sind bereitgestellt durch das CVE Programm von Authorized Data Publishers (ADP) (Unstrukturiert)
Herstellertp-link
≫
Produkt archer_ax3000_firmware
Default Statusunknown
Version 0
Version < v1_1.1.3_build_20240415
Status affected
Herstellertp-link
≫
Produkt archer_axe75_firmware
Default Statusunknown
Version 0
Version < v1_1.2.0_build_20240320
Status affected
Herstellertp-link
≫
Produkt archer_ax5400_firmware
Default Statusunknown
Version 0
Version < v1_1.1.4_build_20240429
Status affected
Herstellertp-link
≫
Produkt archer_axe5400_firmware
Default Statusunknown
Version 0
Version < v1_1.0.3_build_20240319
Status affected
Herstellertp-link
≫
Produkt archer_airr5_firmware
Default Statusunknown
Version 0
Version < v1_1.0.3_build_20240319
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.1% 0.263
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 6.8 0.9 5.9
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.