CVE-2023-32619

Vulnerability

TP-Link Archer C50 firmware versions prior to Archer C50(JP)_V3_230505 and Archer C55 firmware versions prior to Archer C55(JP)_V1_230506 contain hard-coded credentials that are used to authenticate to the device. This flaw allows a network-adjacent unauthenticated attacker to log in with the hard-coded credentials and execute arbitrary OS commands on the affected device [1][2][3].

Exploitation

An attacker must be on the same local network as the target device (network-adjacent position) and does not require any authentication. The attacker can use the hard-coded credentials to gain access to the device's management interface or underlying system and then trigger command injection, leading to remote command execution [3].

Impact

Successful exploitation grants the attacker the ability to execute arbitrary OS commands on the device. This can lead to full compromise of the device, including information disclosure, unauthorized access, and the ability to use the device as a pivot for further attacks within the network [3].

Mitigation

TP-Link has released fixed firmware versions: Archer C50(JP)_V3_230505 for Archer C50 and Archer C55(JP)_V1_230506 for Archer C55. Users should update their firmware to the latest versions via the respective download pages [1][2][3].