« Volver al listado

CVE-2024-38471

Estado: AplazadaMedia (6.8)—

Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by restoring a crafted backup file. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Tp-link — Tp-linkAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-38471",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-38471",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-05T13:55:09.966792Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "TP-LINK",
          "product": "Archer AX3000",
          "versions": [
            {
              "status": "affected",
              "version": "firmware versions prior to \"Archer AX3000(JP)_V1_1.1.3 Build 20240415\""
            }
          ]
        },
        {
          "vendor": "TP-LINK",
          "product": "Archer AXE75",
          "versions": [
            {
              "status": "affected",
              "version": "firmware versions prior to \"Archer AXE75(JP)_V1_1.2.0 Build 20240320\""
            }
          ]
        },
        {
          "vendor": "TP-LINK",
          "product": "Archer AX5400",
          "versions": [
            {
              "status": "affected",
              "version": "firmware versions prior to \"Archer AX5400(JP)_V1_1.1.4 Build 20240429\""
            }
          ]
        },
        {
          "vendor": "TP-LINK",
          "product": "Archer Air R5",
          "versions": [
            {
              "status": "affected",
              "version": "firmware versions prior to \"Archer Air R5(JP)_V1_1.1.6 Build 20240508\""
            }
          ]
        },
        {
          "vendor": "TP-LINK",
          "product": "Archer AXE5400",
          "versions": [
            {
              "status": "affected",
              "version": "firmware versions prior to \"Archer AXE5400(JP)_V1_1.0.3 Build 20240319\""
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:tp-link:archer_ax3000_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "tp-link",
          "product": "archer_ax3000_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "v1_1.1.3_build_20240415",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:o:tp-link:archer_axe75_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "tp-link",
          "product": "archer_axe75_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "v1_1.2.0_build_20240320",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:o:tp-link:archer_ax5400_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "tp-link",
          "product": "archer_ax5400_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "v1_1.1.4_build_20240429",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:o:tp-link:archer_axe5400_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "tp-link",
          "product": "archer_axe5400_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "v1_1.0.3_build_20240319",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:o:tp-link:archer_airr5_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "tp-link",
          "product": "archer_airr5_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "v1_1.0.3_build_20240319",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-07-04T01:15:02.400",
  "references": [
    {
      "url": "https://jvn.jp/en/vu/JVNVU99784493/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.tp-link.com/jp/support/download/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.tp-link.com/jp/support/download/archer-air-r5/v1/#Firmware",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.tp-link.com/jp/support/download/archer-ax3000/#Firmware",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.tp-link.com/jp/support/download/archer-ax5400/#Firmware",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.tp-link.com/jp/support/download/archer-axe5400/#Firmware",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.tp-link.com/jp/support/download/archer-axe75/#Firmware",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/vu/JVNVU99784493/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.tp-link.com/jp/support/download/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.tp-link.com/jp/support/download/archer-air-r5/v1/#Firmware",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.tp-link.com/jp/support/download/archer-ax3000/#Firmware",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.tp-link.com/jp/support/download/archer-ax5400/#Firmware",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.tp-link.com/jp/support/download/archer-axe5400/#Firmware",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.tp-link.com/jp/support/download/archer-axe75/#Firmware",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by restoring a crafted backup file. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi."
    },
    {
      "lang": "es",
      "value": "Múltiples productos TP-LINK permiten a un atacante adyacente a la red con privilegios administrativos ejecutar comandos arbitrarios del sistema operativo mediante la restauración de un archivo de copia de seguridad manipulado. El dispositivo afectado, con la configuración inicial, permite iniciar sesión únicamente desde el puerto LAN o Wi-Fi."
    }
  ],
  "lastModified": "2026-06-17T07:40:20.770",
  "sourceIdentifier": "vultures@jpcert.or.jp"
}