Vulnerability · Published Dec 5, 2024 · Assigned by CERT-In

CVE-2024-54126Insufficient Integrity Verification Vulnerability in TP-Link Archer C50

High 8.5

In plain English

A high-severity security flaw in Archer C50 Wireless Router from TP-Link. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 4.0)8.5High

Exploit odds (30 days)0.1%top 96.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

This vulnerability exists in the TP-Link Archer C50 due to improper signature verification mechanism in the firmware upgrade process at its web interface. An attacker with administrative privileges within the router’s Wi-Fi range could exploit this vulnerability by uploading and executing malicious firmware which could lead to complete compromise of the targeted device.

Affected products (as reported)

Vendor	Product	Versions
TP-Link	Archer C50 Wireless Router	<Archer C50(EU)_V4_ 240917

Weakness: CWE-494, CWE-347 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0354 third-party-advisory