CVE-2023-39224

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

Archer C5 firmware all versions and Archer C7 firmware versions prior to 'Archer C7(JP)_V2_230602' allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Note that Archer C5 is no longer supported, therefore the update for this product is not provided.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
TP-LINK	Archer C5	firmware all versions
TP-LINK	Archer C7	firmware versions prior to 'Archer C7(JP)_V2_230602'
tp-link	archer_c5	< *
tp-link	archer_c7_firmware	v2_230602

References

https://jvn.jp/en/vu/JVNVU99392903/Third Party Advisory
https://www.tp-link.com/jp/support/download/archer-c7/v2/#FirmwareProduct
https://jvn.jp/en/vu/JVNVU99392903/Third Party Advisory
https://www.tp-link.com/jp/support/download/archer-c7/v2/#FirmwareProduct

Timeline

Published: Sep 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-392269.8In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute arbitrary c CVE-2023-392277.5Softneta MedDream PACS stores usernames and passwords in plaintext. The plaintext storage could be abused by attackers to leak legitimate u CVE-2023-392287.5Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network CVE-2023-392307.8Insecure inherited permissions in some Intel Rapid Storage Technology software before version 16.8.5.1014.9 may allow an authenticated user CVE-2023-392316.5PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an exist CVE-2023-392336.5The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may disclose sensitive informat CVE-2023-392347.8Multiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_process_block autosort functionality of GTKWave 3.3.115. A specially cr CVE-2023-392357.8Multiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_process_block autosort functionality of GTKWave 3.3.115. A specially cr CVE-2023-392368.8ASUS RT-AC86U Traffic Analyzer - Statistic function has insufficient filtering of special character. A remote attacker with regular user pri CVE-2023-392378.8ASUS RT-AC86U Traffic Analyzer - Apps analysis function has insufficient filtering of special character. A remote attacker with regular user CVE-2023-392387.2It is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value CVE-2023-392397.2It is identified a format string vulnerability in ASUS RT-AX56U V2’s General function API. This vulnerability is caused by lacking validatio