TP-Link Archer AX3000 v2 Offline Download OS command injection
Anyone with the router's admin login can take control of it.
Summary
The Offline Download feature of TP-Link Archer AX3000 v2 has a command injection flaw when a USB storage device is attached. An authenticated administrator can run arbitrary commands on the device.
Affected when
- USB storage device attached
- Administrator access required
What to do
Update the firmware to 1.1.3 Build 261026 or later.
Update these devices now.
- TP-Link Archer AX3000 v2
Fixed in version 1.1.3 Build 261026.
Products and platforms
CVE IDs
Sources
- Advisory: tp-link.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen