CVE-2024-21773

Опубликовано: 11 янв. 2024

Источник: nvd

CVSS3: 8.8

EPSS Низкий

Описание

Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commands on the product that has pre-specified target devices and blocked URLs in parental control settings.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:tp-link:archer_ax3000_firmware:*:*:*:*:*:*:*:*

Версия до 1.1.2 (исключая)

cpe:2.3:h:tp-link:archer_ax3000:1.0:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:tp-link:archer_ax5400_firmware:*:*:*:*:*:*:*:*

Версия до 1.1.2 (исключая)

cpe:2.3:h:tp-link:archer_ax5400:1.0:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:tp-link:deco_x50_firmware:*:*:*:*:*:*:*:*

Версия до 1.4.1 (исключая)

cpe:2.3:h:tp-link:deco_x50:1.0:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:tp-link:deco_xe200_firmware:*:*:*:*:*:*:*:*

Версия до 1.2.5 (исключая)

cpe:2.3:h:tp-link:deco_xe200:1.0:*:*:*:*:*:*:*

EPSS

Процентиль: 40%

0.00179

Низкий

8.8 High

CVSS3

Дефекты

CWE-78

Связанные уязвимости

GHSA-r8c4-gx74-55m8

CVSS3: 8.8

github

около 2 лет назад

Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands. Affected products/versions are as follows: Archer AX3000 firmware versions prior to "Archer AX3000(JP)_V1_1.1.2 Build 20231115", Archer AX5400 firmware versions prior to "Archer AX5400(JP)_V1_1.1.2 Build 20231115", Deco X50 firmware versions prior to "Deco X50(JP)_V1_1.4.1 Build 20231122", and Deco XE200 firmware versions prior to "Deco XE200(JP)_V1_1.2.5 Build 20231120".

EPSS

Процентиль: 40%

0.00179

Низкий

8.8 High

CVSS3

Дефекты

CWE-78