CVE-2024-21821

Multiple TP-LINK products allow a network-adjacent authenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commands.

Score

CVSS 3.1 8.0 High

Status

Modified - vultures@jpcert.or.jp

Published

2024-01-11

Last modified

2025-06-17

Weaknesses

CWE-78

Affected products

• Archer Air R5 (Tp-link)
• Archer Ax3000 (Tp-link)
• Archer Ax3000 Firmware (Tp-link)
• Archer Ax5400 (Tp-link)
• Archer Ax5400 Firmware (Tp-link)
• Archer Axe75 (Tp-link)
• Archer Axe75 Firmware (Tp-link)

References

• https://jvn.jp/en/vu/JVNVU91401812/
• https://www.tp-link.com/jp/support/download/archer-air-r5/v1/#Firmware
• https://www.tp-link.com/jp/support/download/archer-ax3000/#Firmware
• https://www.tp-link.com/jp/support/download/archer-ax5400/#Firmware
• https://www.tp-link.com/jp/support/download/archer-axe75/#Firmware