CVE-2023-40357

HIGH

TP-LINK Archer AX50/A10/AX10/AX11000 Firmware - Authenticated OS Command Injection

Title source: llm
STIX 2.1

Description

Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer AX50 firmware versions prior to 'Archer AX50(JP)_V1_230529', Archer A10 firmware versions prior to 'Archer A10(JP)_V2_230504', Archer AX10 firmware versions prior to 'Archer AX10(JP)_V1.2_230508', and Archer AX11000 firmware versions prior to 'Archer AX11000(JP)_V1_230523'.

References (5)

Core 5

Scores

CVSS v3 8.0
EPSS 0.0010
EPSS Percentile 26.7%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (4)
tp-link/archer_a10_firmware < 230504
tp-link/archer_ax10_firmware < 230508
tp-link/archer_ax11000_firmware < 230523
tp-link/archer_ax50_firmware < 230529
Published Sep 06, 2023
Tracked Since Feb 18, 2026