CVE-2023-32619

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Archer C50 firmware versions prior to 'Archer C50(JP)_V3_230505' and Archer C55 firmware versions prior to 'Archer C55(JP)_V1_230506' use hard-coded credentials to login to the affected device, which may allow a network-adjacent unauthenticated attacker to execute an arbitrary OS command.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
TP-LINK	Archer C50	firmware versions prior to 'Archer C50(JP)_V3_230505'
TP-LINK	Archer C55	firmware versions prior to 'Archer C55(JP)_V1_230506'
tp-link	archer_c55_firmware	< 230506
tp-link	archer_c50_v3_firmware	< 230505

References

https://jvn.jp/en/vu/JVNVU99392903/Third Party Advisory
https://www.tp-link.com/jp/support/download/archer-c50/v3/#FirmwareProduct
https://www.tp-link.com/jp/support/download/archer-c55/#FirmwareProduct
https://jvn.jp/en/vu/JVNVU99392903/Third Party Advisory
https://www.tp-link.com/jp/support/download/archer-c50/v3/#FirmwareProduct
https://www.tp-link.com/jp/support/download/archer-c55/#FirmwareProduct

Timeline

Published: Sep 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-32626.7The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal CVE-2023-326206.5Improper authentication vulnerability in WL-WN531AX2 firmware versions prior to 2023526 allows a network-adjacent attacker to obtain a passw CVE-2023-326217.2WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS CVE-2023-326227.2Improper neutralization of special elements in WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative priv CVE-2023-326239.1Directory traversal vulnerability in Snow Monkey Forms v5.1.1 and earlier allows a remote unauthenticated attacker to delete arbitrary files CVE-2023-326246.1Cross-site scripting vulnerability in TS Webfonts for SAKURA 3.1.0 and earlier allows a remote unauthenticated attacker to inject an arbitra CVE-2023-326254.3Cross-site request forgery (CSRF) vulnerability in TS Webfonts for SAKURA 3.1.2 and earlier allows a remote unauthenticated attacker to hija CVE-2023-326269.8Hidden functionality vulnerability in LAN-W300N/RS all versions, and LAN-W300N/PR5 all versions allows an unauthenticated attacker to log in CVE-2023-326275.5A floating point exception vulnerability was found in sox, in the read_samples function at sox/src/voc.c:334:18. This flaw can lead to a den CVE-2023-326289.8In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to modify the fil CVE-2023-326297.8Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_CVE-2023-32637.5The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass in the REST API due to the