Unauthenticated OS command execution in TP-Link Archer and Deco products

Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi.

• Archer AX3000: Firmware versions prior to Archer AX3000(JP)_V1_1.1.2 Build 20231115 are affected. TP-Link lists this firmware as the remediation baseline for the Archer AX3000(JP)_V1 branch.
• Archer AX5400: Firmware versions prior to Archer AX5400(JP)_V1_1.1.2 Build 20231115 are affected. TP-Link lists this firmware as the remediation baseline for the Archer AX5400(JP)_V1 branch.
• Archer AXE75: Firmware versions prior to Archer AXE75(JP)_V1_231115 are affected. TP-Link lists this firmware as the remediation baseline for the Archer AXE75(JP)_V1 branch.
• Deco X50: Firmware versions prior to Deco X50(JP)_V1_1.4.1 Build 20231122 are affected. TP-Link lists this firmware as the remediation baseline for the Deco X50(JP)_V1 branch.
• Deco XE200: Firmware versions prior to Deco XE200(JP)_V1_1.2.5 Build 20231120 are affected. TP-Link lists this firmware as the remediation baseline for the Deco XE200(JP)_V1 branch.

The flaw is an OS command injection vulnerability classified as CWE-78. An attacker can provide input that reaches the device's command-processing path, but the public advisory does not identify the vulnerable parameter, endpoint, parser, or internal function. Reachability requires adjacent network access through the LAN port or Wi-Fi; authentication and user interaction are not required. The initial configuration allows login only from the LAN port or Wi-Fi, but this CVE is described as exploitable without logging in. The specific implementation detail and vulnerable firmware component remain undisclosed.

• Reachability: The attacker must be on the adjacent network and able to reach the device through the LAN port or Wi-Fi.
• Authentication: No account or password is required.
• User interaction: No user action is required.
• Complexity: Low according to the supplied normalized record.
• Exploitation status: The supplied record does not identify a known exploitation campaign, ransomware use, or public exploit. The authoritative advisories reviewed also do not publish exploit code or specific indicators. This does not prove that exploitation has not occurred.

The vulnerability permits arbitrary OS command execution on the affected device. The documented impact includes high potential effects on device confidentiality, integrity, and availability because commands may read or change data and configuration or disrupt network operation. The scope is described as unchanged, so current evidence establishes direct impact on the vulnerable device; execution on other hosts or pivoting into other systems has not been established. In an organizational environment, compromise could interrupt connectivity and require validation of device configuration, firmware, and trust status.

Arbitrary OS command execution could expose device data and configuration, alter network settings, or disrupt routing and wireless service. An attacker could also undermine the integrity of firmware or administrative settings, potentially requiring recovery or replacement of the device. Because exploitation requires access to the LAN or Wi-Fi, guest networks, untrusted clients, or broad physical access can increase exposure. The record does not identify a victim, breach, or named campaign.

1. Upgrade each affected model to the corresponding TP-Link remediation firmware:

• Archer AX3000: Archer AX3000(JP)_V1_1.1.2 Build 20231115.
• Archer AX5400: Archer AX5400(JP)_V1_1.1.2 Build 20231115.
• Archer AXE75: Archer AXE75(JP)_V1_231115.
• Deco X50: Deco X50(JP)_V1_1.4.1 Build 20231122.
• Deco XE200: Deco XE200(JP)_V1_1.2.5 Build 20231120.

1. Download firmware from the official TP-Link site for the device's purchase region and hardware revision. Do not use firmware intended for another region or hardware variant.
2. After updating, verify the model, hardware revision, and firmware in the Web management interface or Tether/Deco app. TP-Link states that remediation firmware has been distributed to affected devices and that update notifications may appear through these interfaces.
3. If updating is not yet possible, treat the device as exposed. Restrict LAN and Wi-Fi access to trusted users, devices, and networks, and consider isolating the device until the update is complete. This is a precautionary risk-reduction measure, not a vendor-confirmed patch.
4. The reviewed sources do not document a specific workaround that replaces firmware updating.

1. Inventory all TP-Link devices in scope, including model, hardware revision, and installed firmware. Prioritize Archer AX3000, Archer AX5400, Archer AXE75, Deco X50, and Deco XE200.
2. Check firmware in the Web management interface, Tether, or Deco app, then compare it with the corresponding remediation baselines in affected_summary.
3. Confirm that the device received firmware for the correct region and hardware revision. TP-Link warns that firmware from another region or hardware revision can cause upgrade failures.
4. Review configuration changes, administrative access, unexpected reboots, and firmware changes as precautionary checks. These are review targets, not vendor-confirmed indicators.
5. No specific IOC or log signature is published for this vulnerability. The absence of suspicious events does not prove that a device is safe.