6.8

CVE-2024-38471

Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by restoring a crafted backup file. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung.
Daten sind bereitgestellt durch das CVE Programm von Authorized Data Publishers (ADP) (Unstrukturiert)
Herstellertp-link
≫
Produkt archer_ax3000_firmware
Default Statusunknown
Version < v1_1.1.3_build_20240415
Version 0
Status affected
Herstellertp-link
≫
Produkt archer_axe75_firmware
Default Statusunknown
Version < v1_1.2.0_build_20240320
Version 0
Status affected
Herstellertp-link
≫
Produkt archer_ax5400_firmware
Default Statusunknown
Version < v1_1.1.4_build_20240429
Version 0
Status affected
Herstellertp-link
≫
Produkt archer_axe5400_firmware
Default Statusunknown
Version < v1_1.0.3_build_20240319
Version 0
Status affected
Herstellertp-link
≫
Produkt archer_airr5_firmware
Default Statusunknown
Version < v1_1.0.3_build_20240319
Version 0
Status affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.07% 0.211
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 6.8 0.9 5.9
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.