Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands. Affected products/versions are as follows: Archer AX3000 firmware versions prior to “Archer AX3000(JP)_V1_1.1.2 Build 20231115”, Archer AX5400 firmware versions prior to “Archer AX5400(JP)_V1_1.1.2 Build 20231115”, Deco X50 firmware versions prior to “Deco X50(JP)_V1_1.4.1 Build 20231122”, and Deco XE200 firmware versions prior to “Deco XE200(JP)_V1_1.2.5 Build 20231120”.
CPE | Name | Operator | Version |
---|---|---|---|
archer_ax3000_firmware | lt | 1.1.2 | |
archer_ax5400_firmware | lt | 1.1.2 | |
deco_x50_firmware | lt | 1.4.1 | |
deco_xe200_firmware | lt | 1.2.5 |