CVE-2023-38563 - OpenCVE

Archer C1200 firmware versions prior to 'Archer C1200(JP)_V2_230508' and Archer C9 firmware versions prior to 'Archer C9(JP)_V3_230508' allow a network-adjacent unauthenticated attacker to execute arbitrary OS commands.

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Tp-link	Archer C1200 Archer C9 Firmware Archer C9 Archer C1200 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:tp-link:archer_c1200_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:archer_c1200:2.0:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:tp-link:archer_c9_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:archer_c9:2.0:*:*:*:*:*:*:*

References

Link	Resource
https://jvn.jp/en/vu/JVNVU99392903/	Third Party Advisory
https://www.tp-link.com/jp/support/download/archer-c1200/#Firmware	Product
https://www.tp-link.com/jp/support/download/archer-c9/v3/#Firmware	Product

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: jpcert

Published: 2023-09-06T09:24:08.253Z

Updated: 2023-09-06T09:24:08.253Z

Reserved: 2023-08-15T07:33:37.479Z

Link: CVE-2023-38563

JSON object: View

NVD Information

Status : Analyzed

Published: 2023-09-06T10:15:14.030

Modified: 2023-09-11T13:39:23.730

Link: CVE-2023-38563

JSON object: View

Redhat Information

No data.

CWE

CWE-78

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_c1200_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C389ECDD-7BF0-4BF6-94AB-09BC0E1A8BEF", "versionEndExcluding": "230508", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_c1200:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "A981E118-B897-4B68-A1FB-379C803FD5DC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_c9_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED0E2942-F39F-4A96-8FC0-A14225B58FA5", "versionEndExcluding": "230508", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_c9:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "18F528AA-045C-4111-BFD7-0597CC758E52", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Archer C1200 firmware versions prior to 'Archer C1200(JP)_V2_230508' and Archer C9 firmware versions prior to 'Archer C9(JP)_V3_230508' allow a network-adjacent unauthenticated attacker to execute arbitrary OS commands."}, {"lang": "es", "value": "Las versiones de firmware de Archer C1200 anteriores a 'Archer C1200(JP)_V2_230508' y las versiones de firmware de Archer C9 anteriores a 'Archer C9(JP)_V3_230508' permiten que un atacante no autenticado adyacente a la red ejecute comandos arbitrarios del sistema operativo.\n"}], "id": "CVE-2023-38563", "lastModified": "2023-09-11T13:39:23.730", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-09-06T10:15:14.030", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/vu/JVNVU99392903/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Product"], "url": "https://www.tp-link.com/jp/support/download/archer-c1200/#Firmware"}, {"source": "vultures@jpcert.or.jp", "tags": ["Product"], "url": "https://www.tp-link.com/jp/support/download/archer-c9/v3/#Firmware"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}]}