PT-2024-1570 · Tp Link · Tp-Link

Chuya Hayakawa · Published 2024-01-10 · Updated 2025-09-23 · CVE-2024-21833

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

High

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TP-Link products (affected versions not specified)

Description The issue allows a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi. Millions of routers are potentially at risk.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-01123

CVE-2024-21833

Affected Products

Tp-Link

References · 27

• https://osv.dev/vulnerability/CVE-2024-21833 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21833 · Security Note
• https://bdu.fstec.ru/vul/2024-01123 · Security Note
• https://t.me/pentestingnews/43280 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1752991229674221741 · Twitter Post
• https://twitter.com/elhackernet/status/1753070343881928918 · Twitter Post
• https://twitter.com/RedPacketSec/status/1745386473719738403 · Twitter Post
• https://jvn.jp/en/vu/JVNVU91401812 · Note
• https://t.me/cvenotify/66981 · Telegram Post
• https://twitter.com/Zowae_/status/1753063305919299642 · Twitter Post
• https://tp-link.com/jp/support/download/archer-ax5400/#Firmware · Note
• https://twitter.com/Komodosec/status/1753003903480910088 · Twitter Post
• https://tp-link.com/jp/support/download/archer-ax3000/#Firmware · Note
• https://tp-link.com/jp/support/download/deco-x50/v1/#Firmware · Note
• https://twitter.com/fletch_ai/status/1753329164034167097 · Twitter Post