PT-2024-9110 · Tp Link · Tp-Link Tapo Series+2

Thottysploity

·

Published

2024-11-20

·

Updated

2025-12-01

·

CVE-2024-53375

CVSS v3.1

8.0

High

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions TP-Link Archer Series routers TP-Link Deco Series routers TP-Link Tapo Series routers
Description An authenticated remote code execution (RCE) issue exists in the tmp get sites function of the HomeShield functionality provided by TP-Link. This issue is exploitable even without the installation or activation of the HomeShield functionality. The vulnerability is due to a lack of request parameter validation. The tmp get sites function appears to be susceptible to command injection, potentially allowing an attacker to execute arbitrary commands remotely.
Recommendations TP-Link Archer Series routers: At the moment, there is no information about a newer version that contains a fix for this vulnerability. TP-Link Deco Series routers: At the moment, there is no information about a newer version that contains a fix for this vulnerability. TP-Link Tapo Series routers: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-10792
CVE-2024-53375

Affected Products

Tp-Link Archer Series
Tp-Link Deco Series
Tp-Link Tapo Series