PT-2023-5275 · Tp Link · Tp-Link Archer A10

Published 2023-09-06 · Updated 2023-09-11 · CVE-2023-38568

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TP-Link Archer A10 firmware versions prior to Archer A10(JP) V2 230504

Description The issue exists due to the lack of measures to neutralize special elements used in the operating system command. This allows a network-adjacent unauthenticated attacker to execute arbitrary OS commands.

Recommendations For TP-Link Archer A10 firmware versions prior to Archer A10(JP) V2 230504, update the firmware to version Archer A10(JP) V2 230504 or later to resolve the issue.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-05896

CVE-2023-38568

Affected Products

Tp-Link Archer A10

References · 9

• https://osv.dev/vulnerability/CVE-2023-38568 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38568 · Security Note
• https://bdu.fstec.ru/vul/2023-05896 · Security Note
• https://twitter.com/CVEnew/status/1699356403323089075 · Twitter Post
• https://jvn.jp/en/vu/JVNVU99392903 · Note
• https://t.me/cvenotify/57936 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1699401416140321047 · Twitter Post
• https://tp-link.com/jp/support/download/archer-a10/#Firmware · Note
• https://t.me/cibsecurity/69981 · Telegram Post