Log in Start free

Vulnerability · Published Sep 6, 2023 · Assigned by jpcert

CVE-2023-40357

High 8.0

In plain English

A high-severity OS command injection in Archer A10 from TP-LINK. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)8.0High
Exploit odds (30 days)0.5%top 57.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer AX50 firmware versions prior to 'Archer AX50(JP)_V1_230529', Archer A10 firmware versions prior to 'Archer A10(JP)_V2_230504', Archer AX10 firmware versions prior to 'Archer AX10(JP)_V1.2_230508', and Archer AX11000 firmware versions prior to 'Archer AX11000(JP)_V1_230523'.

Affected products (as reported)

VendorProductVersions
TP-LINK Archer AX50 firmware versions prior to 'Archer AX50(JP)_V1_230529'
TP-LINK Archer A10 firmware versions prior to 'Archer A10(JP)_V2_230504'
TP-LINK Archer AX10 firmware versions prior to 'Archer AX10(JP)_V1.2_230508'
TP-LINK Archer AX11000 firmware versions prior to 'Archer AX11000(JP)_V1_230523'

Weakness: CWE-78 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References