CVE-2023-37284

2023-09-0609:24:42

jpcert

github.com

archer c20

firmware

authentication

vulnerability

network-adjacent

attacker

arbitrary os command

crafted request

AI Score

7.7

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Improper authentication vulnerability in Archer C20 firmware versions prior to ‘Archer C20(JP)_V1_230616’ allows a network-adjacent unauthenticated attacker to execute an arbitrary OS command via a crafted request to bypass authentication.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:o:tp-link:archer_c20_firmware:230616:*:*:*:*:*:*:*"
    ],
    "vendor": "tp-link",
    "product": "archer_c20_firmware",
    "versions": [
      {
        "status": "affected",
        "version": "v1_230616"
      }
    ],
    "defaultStatus": "unknown"
  }
]