Riskcovery

CVE-2023-31188

State
Published
Severity
8.0 High
Published
Sep 6, 2023
Updated
Sep 27, 2024
Reserved
Aug 15, 2023

Read the record on cve.org

Description

Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer C50 firmware versions prior to 'Archer C50(JP)_V3_230505', Archer C55 firmware versions prior to 'Archer C55(JP)_V1_230506', and Archer C20 firmware versions prior to 'Archer C20(JP)_V1_230616'.

Scores

CVSSScoreVectorSource
3.18.0 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCISA-ADP

Weaknesses

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

ProductVersions
Archer C50TP-LINK
  • firmware versions prior to 'Archer C50(JP)_V3_230505'Affected
Archer C55TP-LINK
  • firmware versions prior to 'Archer C55(JP)_V1_230506'Affected
Archer C20TP-LINK
  • firmware versions prior to 'Archer C20(JP)_V1_230616'Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.