An authenticated OS command injection vulnerability exists in the Offline Download component (USB storage allocation) of Archer AX3000 v2.
An authenticated OS command injection vulnerability exists in the Offline Download component (USB storage allocation) of Archer AX3000 v2. When a USB storage device is attached, an authenticated administrator can submit a crafted path value containing shell metacharacters that is not properly neutralized before being passed to a system command. Successful exploitation may allow arbitrary command execution on the affected device.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- TP-Link
- Product
- Archer AX3000 v2
- CVSS v4.0
- 7.3 AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weakness
- CWE-78
- Exposure class
- Edge / VPN / firewall
- NVD status
- Received
Why it ranks 37 (Notable)
- CVSS v4.0 7.3 high
- Exposed product class: edge / VPN / firewall
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.