CVE-2024-21773
HIGH 8.8EPSS 0.5%
Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commands on the product that has pre-specified target devices and blocked URLs in parental control settings.
- Affected
- TP-Link · Archer AX3000 · Archer AX5400 · Deco X50 · Deco XE200 · Archer Air R5
- CVSS v3.1 NVD
- 8.8 HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 0.53% chance of exploitation in the next 30 days, 44th percentile
- Published
- 2024-01-10
- Updated
- 2025-06-03
Proof-of-concept exploits (1)
- neighborhood-H/1-DAY_Confirmation2★ · 2025-12-22
Security advisories
- https://jvn.jp/en/vu/JVNVU91401812
- https://www.tp-link.com/jp/support/download/archer-ax3000/#Firmware
- https://www.tp-link.com/jp/support/download/archer-ax5400/#Firmware
- https://www.tp-link.com/jp/support/download/deco-x50/v1/#Firmware
- https://www.tp-link.com/jp/support/download/deco-xe200/#Firmware