CVE-2024-38471

Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to...

6.8 Medium

Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by restoring a crafted backup file. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.36%Up 0.3 points since Jul 4, 2024

What each source reports

CVE List Score used 6.8

Record: CVE-2024-38471
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

EUVDEUVD-2024-37352 6.8

Record: EUVD-2024-37352
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-37mw-xfjf-m6pf 6.8

Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to...

Record: GHSA-37mw-xfjf-m6pf
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

NVD 6.8

Record: CVE-2024-38471
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-38471 is a medium vulnerability (CVSS 6.8) in Tp-link Archer Air R5, published July 4, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. No source names a fixed version.