Riskcovery

CVE-2023-40357

State
Published
Severity
8.0 High
Published
Sep 6, 2023
Updated
Sep 27, 2024
Reserved
Aug 15, 2023

Read the record on cve.org

Description

Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer AX50 firmware versions prior to 'Archer AX50(JP)_V1_230529', Archer A10 firmware versions prior to 'Archer A10(JP)_V2_230504', Archer AX10 firmware versions prior to 'Archer AX10(JP)_V1.2_230508', and Archer AX11000 firmware versions prior to 'Archer AX11000(JP)_V1_230523'.

Scores

CVSSScoreVectorSource
3.18.0 HighCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCISA-ADP

Weaknesses

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

ProductVersions
Archer AX50TP-LINK
  • firmware versions prior to 'Archer AX50(JP)_V1_230529'Affected
Archer A10TP-LINK
  • firmware versions prior to 'Archer A10(JP)_V2_230504'Affected
Archer AX10TP-LINK
  • firmware versions prior to 'Archer AX10(JP)_V1.2_230508'Affected
Archer AX11000TP-LINK
  • firmware versions prior to 'Archer AX11000(JP)_V1_230523'Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.