Lucene search

JpcertCVE-2023-32619

HistorySep 06, 2023 - 10:15 a.m.

CVE-2023-32619

2023-09-0610:15:13

CWE-798

jpcert

web.nvd.nist.gov

cve-2023-32619

archer c50

archer c55

firmware

unauthorized access

hard-coded credentials

nvd

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

26.8%

JSON

Archer C50 firmware versions prior to ‘Archer C50(JP)_V3_230505’ and Archer C55 firmware versions prior to ‘Archer C55(JP)_V1_230506’ use hard-coded credentials to login to the affected device, which may allow a network-adjacent unauthenticated attacker to execute an arbitrary OS command.

Affected configurations

Nvd

Node

tp-linkarcher_c55_firmwareRange<230506

AND

tp-linkarcher_c55Match-

Node

tp-linkarcher_c50_v3_firmwareRange<230505

AND

tp-linkarcher_c50_v3Match-

VendorProductVersionCPE
tp-linkarcher_c55_firmware*cpe:2.3:o:tp-link:archer_c55_firmware:*:*:*:*:*:*:*:*
tp-linkarcher_c55-cpe:2.3:h:tp-link:archer_c55:-:*:*:*:*:*:*:*
tp-linkarcher_c50_v3_firmware*cpe:2.3:o:tp-link:archer_c50_v3_firmware:*:*:*:*:*:*:*:*
tp-linkarcher_c50_v3-cpe:2.3:h:tp-link:archer_c50_v3:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
tp-link	archer_c55_firmware	*	cpe:2.3:o:tp-link:archer_c55_firmware::::::::
tp-link	archer_c55	-	cpe:2.3:h:tp-link:archer_c55:-:::::::*
tp-link	archer_c50_v3_firmware	*	cpe:2.3:o:tp-link:archer_c50_v3_firmware::::::::
tp-link	archer_c50_v3	-	cpe:2.3:h:tp-link:archer_c50_v3:-:::::::*

CNA Affected

[
  {
    "vendor": "TP-LINK",
    "product": "Archer C50",
    "versions": [
      {
        "version": "firmware versions prior to 'Archer C50(JP)_V3_230505'",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "TP-LINK",
    "product": "Archer C55",
    "versions": [
      {
        "version": "firmware versions prior to 'Archer C55(JP)_V1_230506'",
        "status": "affected"
      }
    ]
  }
]

References

jvn.jp/en/vu/JVNVU99392903/

www.tp-link.com/jp/support/download/archer-c50/v3/#Firmware

www.tp-link.com/jp/support/download/archer-c55/#Firmware

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

26.8%

JSON

Related for CVE-2023-32619