PT-2025-6006 · Tp Link · Tplink Tl-Wpa 8630

C10Uds · Published 2025-02-07 · Updated 2025-07-03 · CVE-2024-57357

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TPLINK TL-WPA 8630 version 2.0.4 Build 20230427

Description An issue allows a remote attacker to execute arbitrary code via the function sub 4256CC(), which allows command injection by injecting the devpwd variable.

Recommendations For TPLINK TL-WPA 8630 version 2.0.4 Build 20230427, consider restricting access to the sub 4256CC() function to minimize the risk of exploitation. Avoid using the devpwd variable in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-09011

CVE-2024-57357

Affected Products

Tplink Tl-Wpa 8630

References · 9

• 🔥 https://github.com/c10uds/tplink-wpa8630-rce-vulnerability · Exploit
• https://bdu.fstec.ru/vul/2025-09011 · Security Note
• https://osv.dev/vulnerability/CVE-2024-57357 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-57357 · Security Note
• https://t.me/cvenotify/127536 · Telegram Post
• https://twitter.com/bluepinksec/status/1888656368619385182 · Twitter Post
• https://t.me/cvedetector/17527 · Telegram Post
• https://twitter.com/cybercronai/status/1888353442621521972 · Twitter Post
• https://twitter.com/CVEnew/status/1887992550717632886 · Twitter Post