{"id":"CVE-2024-21773","aliases":["EUVD-2024-19387","GHSA-r8c4-gx74-55m8"],"status":"published","title":"Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the...","description":"Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commands on the product that has pre-specified target devices and blocked URLs in parental control settings.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00531,"percentile":0.45137,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2024-01-10T23:24:50Z","modified":"2026-06-17T07:10:08Z","products":[{"vendor":"tp-link","product":"archer air r5"},{"vendor":"tp-link","product":"archer ax3000"},{"vendor":"tp-link","product":"archer ax5400"},{"vendor":"tp-link","product":"archer_ax3000_firmware"},{"vendor":"tp-link","product":"archer_ax5400_firmware"},{"vendor":"tp-link","product":"deco x50"},{"vendor":"tp-link","product":"deco xe200"},{"vendor":"tp-link","product":"deco_x50_firmware"},{"vendor":"tp-link","product":"deco_xe200_firmware"}],"references":[{"url":"https://www.tp-link.com/jp/support/download/archer-ax3000/#Firmware","tags":["x_transferred","Product"]},{"url":"https://www.tp-link.com/jp/support/download/archer-ax5400/#Firmware","tags":["x_transferred","Product"]},{"url":"https://www.tp-link.com/jp/support/download/deco-x50/v1/#Firmware","tags":["x_transferred","Product"]},{"url":"https://www.tp-link.com/jp/support/download/deco-xe200/#Firmware","tags":["x_transferred","Product"]},{"url":"https://www.tp-link.com/jp/support/download/archer-air-r5/v1/#Firmware","tags":["x_transferred"]},{"url":"https://jvn.jp/en/vu/JVNVU91401812/","tags":["x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21773"},{"url":"https://jvn.jp/en/vu/JVNVU91401812"},{"url":"https://github.com/advisories/GHSA-r8c4-gx74-55m8"}],"sources":{"cve":[{"id":"CVE-2024-21773","description":"Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commands on the product that has pre-specified target devices and blocked URLs in parental control settings.","status":"published","published":"2024-01-10T23:24:50.112Z","modified":"2025-06-03T14:26:17.285Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:04.681315Z"}],"euvd":[{"id":"EUVD-2024-19387","description":"Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commands on the product that has pre-specified target devices and blocked URLs in parental control settings.","status":"published","published":"2024-01-10T23:24:50Z","modified":"2025-06-03T14:26:17Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:31.558173Z"}],"ghsa":[{"id":"GHSA-r8c4-gx74-55m8","title":"Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the...","description":"Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands. Affected products/versions are as follows: Archer AX3000 firmware versions prior to \"Archer AX3000(JP)_V1_1.1.2 Build 20231115\", Archer AX5400 firmware versions prior to \"Archer AX5400(JP)_V1_1.1.2 Build 20231115\", Deco X50 firmware versions prior to \"Deco X50(JP)_V1_1.4.1 Build 20231122\", and Deco XE200 firmware versions prior to \"Deco XE200(JP)_V1_1.2.5 Build 20231120\".","status":"published","published":"2024-01-11T00:30:26Z","modified":"2024-07-04T00:37:44Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:57:38.695929Z"}],"nvd":[{"id":"CVE-2024-21773","description":"Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commands on the product that has pre-specified target devices and blocked URLs in parental control settings.","status":"published","published":"2024-01-11T00:15:44.56Z","modified":"2026-06-17T07:10:08.3Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:09:30.070039Z"}]}}