Description
Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commands on the product that has pre-specified target devices and blocked URLs in parental control settings.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
TP-Link Archer AX3000
firmware versions prior to "Archer AX3000(JP)_V1_1.1.2 Build 20231115"affected
TP-Link Archer AX5400
firmware versions prior to "Archer AX5400(JP)_V1_1.1.2 Build 20231115"affected
TP-Link Deco X50
firmware versions prior to "Deco X50(JP)_V1_1.4.1 Build 20231122"affected
TP-Link Deco XE200
firmware versions prior to "Deco XE200(JP)_V1_1.2.5 Build 20231120"affected
TP-Link Archer Air R5
firmware versions prior to "Archer Air R5(JP)_V1_1.1.6 Build 20240508"affected
References
- https://www.tp-link.com/jp/support/download/archer-ax3000/#Firmware ↗
- https://www.tp-link.com/jp/support/download/archer-ax5400/#Firmware ↗
- https://www.tp-link.com/jp/support/download/deco-x50/v1/#Firmware ↗
- https://www.tp-link.com/jp/support/download/deco-xe200/#Firmware ↗
- https://www.tp-link.com/jp/support/download/archer-air-r5/v1/#Firmware ↗
- https://jvn.jp/en/vu/JVNVU91401812/ ↗