cve/2024/CVE-2024-21833.md

### [CVE-2024-21833](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21833)
![](https://img.shields.io/static/v1?label=Product&message=Archer%20AX3000&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Archer%20AX5400&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Archer%20AXE75&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Deco%20X50&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Deco%20XE200&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20firmware%20versions%20prior%20to%20%22Archer%20AX3000(JP)_V1_1.1.2%20Build%2020231115%22%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20firmware%20versions%20prior%20to%20%22Archer%20AX5400(JP)_V1_1.1.2%20Build%2020231115%22%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20firmware%20versions%20prior%20to%20%22Archer%20AXE75(JP)_V1_231115%22%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20firmware%20versions%20prior%20to%20%22Deco%20X50(JP)_V1_1.4.1%20Build%2020231122%22%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20firmware%20versions%20prior%20to%20%22Deco%20XE200(JP)_V1_1.2.5%20Build%2020231120%22%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=OS%20command%20injection&color=brighgreen)

### Description

Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/H4lo/awesome-IoT-security-article