First published: Wed Jan 10 2024(Updated: )
Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi.
Credit: vultures@jpcert.or.jp
Affected Software | Affected Version | How to fix |
---|---|---|
All of | ||
TP-Link Archer AX3000 | <1.1.2 | |
TP-Link Archer AX3000 | =1.0 | |
All of | ||
TP-Link Archer AX5400 Firmware | <1.1.2 | |
TP-Link Archer AX5400 Firmware | =1.0 | |
All of | ||
TP-Link Deco X50 | <1.4.1 | |
Tp-link Deco X50 Firmware | =1.0 | |
All of | ||
TP-Link Deco XE200 Firmware | <1.2.5 | |
Tp-link Deco Xe200 Firmware | =1.0 | |
All of | ||
TP-Link Archer AXE75 Firmware | <1.1.9 | |
TP-Link Archer AXE75 Firmware | =1.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2024-21833 is classified as a high severity vulnerability due to the potential for unauthenticated remote command execution.
To mitigate CVE-2024-21833, update your affected TP-LINK products to the latest firmware version provided by TP-LINK.
CVE-2024-21833 affects several TP-LINK devices including the Archer AX3000, Archer AX5400, Deco X50, Deco XE200, and Archer AXE75.
CVE-2024-21833 can be exploited by an unauthenticated attacker who has network access to the affected device.
CVE-2024-21833 can facilitate arbitrary OS command execution, which may lead to further compromise of the device and network.