deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-30714
Published: 2023-09-06
Description: Improper authorization vulnerability in FolderContainerDragDelegate in One UI Home prior to SMR Sep-2023 Release 1 allows physical attackers to change some settings of the folder lock.
CVSS Score: 4.6 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=09
CVE: CVE-2023-30715
Published: 2023-09-06
Description: Improper access control vulnerability in Weather prior to SMR Sep-2023 Release 1 allows attackers to access location information set in Weather without permission.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=09
CVE: CVE-2023-30716
Published: 2023-09-06
Description: Improper access control vulnerability in SVCAgent prior to SMR Sep-2023 Release 1 allows attackers to trigger certain commands.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=09
CVE: CVE-2023-30717
Published: 2023-09-06
Description: Sensitive information exposure vulnerability in SVCAgent prior to SMR Sep-2023 Release 1 allows attackers to get unresettable identifiers.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=09
CVE: CVE-2023-30718
Published: 2023-09-06
Description: Improper export of android application components vulnerability in WifiApAutoHotspotEnablingActivity prior to SMR Sep-2023 Release 1 allows local attacker to change a Auto Hotspot setting.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=09
CVE: CVE-2023-30719
Published: 2023-09-06
Description: Exposure of Sensitive Information vulnerability in InboundSmsHandler prior to SMR Sep-2023 Release 1 allows local attackers to access certain message data.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=09
CVE: CVE-2023-30720
Published: 2023-09-06
Description: PendingIntent hijacking in LmsAssemblyTrackerCTC prior to SMR Sep-2023 Release 1 allows local attacker to gain arbitrary file access.
CVSS Score: 4.7 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=09
CVE: CVE-2023-30721
Published: 2023-09-06
Description: Insertion of sensitive information into log vulnerability in Locksettings prior to SMR Sep-2023 Release 1 allows a privileged local attacker to get lock screen match information from the log.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=09; https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=09
CVE: CVE-2023-30722
Published: 2023-09-06
Description: Protection Mechanism Failure in bc_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.13.5 allows local attacker to execute arbitrary code.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=09
CVE: CVE-2023-30723
Published: 2023-09-06
Description: Improper input validation vulnerability in Samsung Health prior to version 6.24.2.011 allows attackers to write arbitrary file with Samsung Health privilege.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=09
CVE: CVE-2023-30724
Published: 2023-09-06
Description: Improper authentication in GallerySearchProvider of Gallery prior to version 14.5.01.2 allows attacker to access search history.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=09
CVE: CVE-2023-30725
Published: 2023-09-06
Description: Improper authentication in LocalProvier of Gallery prior to version 14.5.01.2 allows attacker to access the data in content provider.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-287
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=09
CVE: CVE-2023-30726
Published: 2023-09-06
Description: PendingIntent hijacking vulnerability in GameLauncher prior to version 4.2.59.5 allows local attackers to access data.
CVSS Score: 4.7 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=09
CVE: CVE-2023-30728
Published: 2023-09-06
Description: Intent redirection vulnerability in PackageInstallerCHN prior to version 13.1.03.00 allows local attacker to access arbitrary file. This vulnerability requires user interaction.
CVSS Score: 4.4 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=09
CVE: CVE-2023-30729
Published: 2023-09-06
Description: Improper Certificate Validation in Samsung Email prior to version 6.1.82.0 allows remote attacker to intercept the network traffic including sensitive information.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=09
CVE: CVE-2023-30730
Published: 2023-09-06
Description: Implicit intent hijacking vulnerability in Camera prior to versions 11.0.16.43 in Android 11, 12.1.00.30, 12.0.07.53, 12.1.03.10 in Android 12, and 13.0.01.43, 13.1.00.83 in Android 13 allows local attacker to access specific file.
CVSS Score: 3.3 (LOW)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=09; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=09
CVE: CVE-2023-4773
Published: 2023-09-06
Description: The WordPress Social Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wordpress_social_login_meta' shortcode in versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wordpress-social-login/tags/3.0.4/includes/widgets/wsl.auth.widgets.php#L413; https://www.wordfence.com/threat-intel/vulnerabilities/id/b987822d-2b1b-4f79-988b-4bd731864b63?source=cve; https://plugins.trac.wordpress.org/browser/wordpress-social-login/tags/3.0.4/includes/widgets/wsl.auth.widgets.php#L413
CVE: CVE-2023-32162
Published: 2023-09-06
Description: Wacom Drivers for Windows Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Wacom Drivers for Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the handling of the WacomInstallI.txt file by the PrefUtil.exe utility. The issue results from incorrect permissions on the WacomInstallI.txt file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-16318.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.zerodayinitiative.com/advisories/ZDI-23-741; https://www.zerodayinitiative.com/advisories/ZDI-23-741
CVE: CVE-2023-32163
Published: 2023-09-06
Description: Wacom Drivers for Windows Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Wacom Drivers for Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the Tablet Service. By creating a symbolic link, an attacker can abuse the service to create a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-16857.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://www.zerodayinitiative.com/advisories/ZDI-23-742; https://www.zerodayinitiative.com/advisories/ZDI-23-742
CVE: CVE-2023-35719
Published: 2023-09-06
Description: ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of ManageEngine ADSelfService Plus. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the Password Reset Portal used by the GINA client. The issue results from the lack of proper authentication of data received via HTTP. An attacker can leverage this vulnerability to bypass authentication and execute code in the context of SYSTEM. Was ZDI-CAN-17009.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-345
References: https://www.manageengine.com/products/self-service-password/kb/our-response-to-CVE-2023-35719.html; https://www.zerodayinitiative.com/advisories/ZDI-23-891; https://www.manageengine.com/products/self-service-password/kb/our-response-to-CVE-2023-35719.html
CVE: CVE-2023-3471
Published: 2023-09-06
Description: Buffer overflow vulnerability in Panasonic KW Watcher versions 1.00 through 2.82 may allow attackers to execute arbitrary code.
CVSS Score: 8.6 (HIGH)
CWE: CWE-119, CWE-120
References: https://www3.panasonic.biz/ac/e/fasys/software_info/eco/kwwatcher_versioninfo.jsp; https://www3.panasonic.biz/ac/j/fasys/software_info/eco/tol_kwwatcher.jsp; https://www3.panasonic.biz/ac/e/fasys/software_info/eco/kwwatcher_versioninfo.jsp
CVE: CVE-2023-3472
Published: 2023-09-06
Description: Use after free vulnerability in Panasonic KW Watcher versions 1.00 through 2.82 may allow attackers to execute arbitrary code.
CVSS Score: 8.6 (HIGH)
CWE: CWE-416, CWE-416
References: https://www3.panasonic.biz/ac/e/fasys/software_info/eco/kwwatcher_versioninfo.jsp; https://www3.panasonic.biz/ac/j/fasys/software_info/eco/tol_kwwatcher.jsp; https://www3.panasonic.biz/ac/e/fasys/software_info/eco/kwwatcher_versioninfo.jsp
CVE: CVE-2023-4779
Published: 2023-09-06
Description: The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [usp_gallery] shortcode in versions up to, and including, 20230811 due to insufficient input sanitization and output escaping on user supplied attributes like 'before'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2961841; https://www.wordfence.com/threat-intel/vulnerabilities/id/d21ca709-183f-4dd1-849c-f1b2a4f7ec43?source=cve; https://plugins.trac.wordpress.org/changeset/2961841
CVE: CVE-2023-29441
Published: 2023-09-06
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Robert Heller WebLibrarian plugin <= 3.5.8.1 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/weblibrarian/wordpress-weblibrarian-plugin-3-5-8-1-multiple-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/weblibrarian/wordpress-weblibrarian-plugin-3-5-8-1-multiple-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-4705
Published: 2023-09-06
Description: Rejected reason: CVE-2023-4705 was wrongly assigned to a bug that was deemed to be a non-security issue by the Linux kernel security team.
CVE: CVE-2023-30497
Published: 2023-09-06
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Simon Chuang WP LINE Notify plugin <= 1.4.4 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-line-notify/wordpress-wordpress-line-notify-plugin-1-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-line-notify/wordpress-wordpress-line-notify-plugin-1-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-40007
Published: 2023-09-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ujwol Bastakoti CT Commerce plugin <= 2.0.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ct-commerce/wordpress-ct-commerce-plugin-2-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ct-commerce/wordpress-ct-commerce-plugin-2-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-40328
Published: 2023-09-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Carrrot plugin <= 1.1.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/carrrot/wordpress-carrot-plugin-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/carrrot/wordpress-carrot-plugin-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-40329
Published: 2023-09-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPZest Custom Admin Login Page | WPZest plugin <= 1.2.0 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/custom-admin-login-styler-wpzest/wordpress-custom-admin-login-page-wpzest-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/custom-admin-login-styler-wpzest/wordpress-custom-admin-login-page-wpzest-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-40552
Published: 2023-09-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gurcharan Singh Fitness calculators plugin plugin <= 2.0.7 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/fitness-calculators/wordpress-fitness-calculators-plugin-plugin-2-0-7-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/fitness-calculators/wordpress-fitness-calculators-plugin-plugin-2-0-7-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-40553
Published: 2023-09-06
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Plausible.Io Plausible Analytics plugin <= 1.3.3 versions.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/plausible-analytics/wordpress-plausible-analytics-plugin-1-3-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/plausible-analytics/wordpress-plausible-analytics-plugin-1-3-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-40554
Published: 2023-09-06
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Blog2Social, Adenion Blog2Social: Social Media Auto Post & Scheduler plugin <= 7.2.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/blog2social/wordpress-blog2social-plugin-7-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/blog2social/wordpress-blog2social-plugin-7-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-40560
Published: 2023-09-06
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Greg Ross Schedule Posts Calendar plugin <= 5.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/schedule-posts-calendar/wordpress-schedule-posts-calendar-plugin-5-2-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/schedule-posts-calendar/wordpress-schedule-posts-calendar-plugin-5-2-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2023-40601
Published: 2023-09-06
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Estatik Estatik Mortgage Calculator plugin <= 2.0.7 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/estatik-mortgage-calculator/wordpress-mortgage-calculator-estatik-plugin-2-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/estatik-mortgage-calculator/wordpress-mortgage-calculator-estatik-plugin-2-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-4634
Published: 2023-09-06
Description: The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from the ~/includes/mla-stream-image.php file, where images are processed via Imagick(). This makes it possible for unauthenticated attackers to supply files via FTP that will make directory lists, local file inclusion, and remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-73
References: https://github.com/Patrowl/CVE-2023-4634/; https://packetstormsecurity.com/files/174508/wpmla309-lfiexec.tgz; https://patrowl.io/blog-wordpress-media-library-rce-cve-2023-4634/
CVE: CVE-2023-31188
Published: 2023-09-06
Description: Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer C50 firmware versions prior to 'Archer C50(JP)_V3_230505', Archer C55 firmware versions prior to 'Archer C55(JP)_V1_230506', and Archer C20 firmware versions prior to 'Archer C20(JP)_V1_230616'.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://jvn.jp/en/vu/JVNVU99392903/; https://www.tp-link.com/jp/support/download/archer-c20/v1/#Firmware; https://www.tp-link.com/jp/support/download/archer-c50/v3/#Firmware
CVE: CVE-2023-32619
Published: 2023-09-06
Description: Archer C50 firmware versions prior to 'Archer C50(JP)_V3_230505' and Archer C55 firmware versions prior to 'Archer C55(JP)_V1_230506' use hard-coded credentials to login to the affected device, which may allow a network-adjacent unauthenticated attacker to execute an arbitrary OS command.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798, CWE-798
References: https://jvn.jp/en/vu/JVNVU99392903/; https://www.tp-link.com/jp/support/download/archer-c50/v3/#Firmware; https://www.tp-link.com/jp/support/download/archer-c55/#Firmware
CVE: CVE-2023-36489
Published: 2023-09-06
Description: Multiple TP-LINK products allow a network-adjacent unauthenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: TL-WR802N firmware versions prior to 'TL-WR802N(JP)_V4_221008', TL-WR841N firmware versions prior to 'TL-WR841N(JP)_V14_230506', and TL-WR902AC firmware versions prior to 'TL-WR902AC(JP)_V3_230506'.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU99392903/; https://www.tp-link.com/jp/support/download/tl-wr802n/#Firmware; https://www.tp-link.com/jp/support/download/tl-wr841n/v14/#Firmware
CVE: CVE-2023-37284
Published: 2023-09-06
Description: Improper authentication vulnerability in Archer C20 firmware versions prior to 'Archer C20(JP)_V1_230616' allows a network-adjacent unauthenticated attacker to execute an arbitrary OS command via a crafted request to bypass authentication.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://jvn.jp/en/vu/JVNVU99392903/; https://www.tp-link.com/jp/support/download/archer-c20/v1/#Firmware; https://jvn.jp/en/vu/JVNVU99392903/
CVE: CVE-2023-38563
Published: 2023-09-06
Description: Archer C1200 firmware versions prior to 'Archer C1200(JP)_V2_230508' and Archer C9 firmware versions prior to 'Archer C9(JP)_V3_230508' allow a network-adjacent unauthenticated attacker to execute arbitrary OS commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU99392903/; https://www.tp-link.com/jp/support/download/archer-c1200/#Firmware; https://www.tp-link.com/jp/support/download/archer-c9/v3/#Firmware
CVE: CVE-2023-38568
Published: 2023-09-06
Description: Archer A10 firmware versions prior to 'Archer A10(JP)_V2_230504' allows a network-adjacent unauthenticated attacker to execute arbitrary OS commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU99392903/; https://www.tp-link.com/jp/support/download/archer-a10/#Firmware; https://jvn.jp/en/vu/JVNVU99392903/
CVE: CVE-2023-38588
Published: 2023-09-06
Description: Archer C3150 firmware versions prior to 'Archer C3150(JP)_V2_230511' allows a network-adjacent authenticated attacker to execute arbitrary OS commands.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://jvn.jp/en/vu/JVNVU99392903/; https://www.tp-link.com/jp/support/download/archer-c3150/#Firmware; https://jvn.jp/en/vu/JVNVU99392903/
CVE: CVE-2023-39224
Published: 2023-09-06
Description: Archer C5 firmware all versions and Archer C7 firmware versions prior to 'Archer C7(JP)_V2_230602' allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Note that Archer C5 is no longer supported, therefore the update for this product is not provided.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU99392903/; https://www.tp-link.com/jp/support/download/archer-c7/v2/#Firmware; https://jvn.jp/en/vu/JVNVU99392903/
CVE: CVE-2023-39935
Published: 2023-09-06
Description: Archer C5400 firmware versions prior to 'Archer C5400(JP)_V2_230506' allows a network-adjacent authenticated attacker to execute arbitrary OS commands.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU99392903/; https://www.tp-link.com/jp/support/download/archer-c5400/#Firmware; https://jvn.jp/en/vu/JVNVU99392903/
CVE: CVE-2023-40193
Published: 2023-09-06
Description: Deco M4 firmware versions prior to 'Deco M4(JP)_V2_1.5.8 Build 20230619' allows a network-adjacent authenticated attacker to execute arbitrary OS commands.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU99392903/; https://www.tp-link.com/jp/support/download/deco-m4/v2/#Firmware; https://jvn.jp/en/vu/JVNVU99392903/
CVE: CVE-2023-40357
Published: 2023-09-06
Description: Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer AX50 firmware versions prior to 'Archer AX50(JP)_V1_230529', Archer A10 firmware versions prior to 'Archer A10(JP)_V2_230504', Archer AX10 firmware versions prior to 'Archer AX10(JP)_V1.2_230508', and Archer AX11000 firmware versions prior to 'Archer AX11000(JP)_V1_230523'.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://jvn.jp/en/vu/JVNVU99392903/; https://www.tp-link.com/jp/support/download/archer-a10/#Firmware; https://www.tp-link.com/jp/support/download/archer-ax10/#Firmware
CVE: CVE-2023-40531
Published: 2023-09-06
Description: Archer AX6000 firmware versions prior to 'Archer AX6000(JP)_V1_1.3.0 Build 20221208' allows a network-adjacent authenticated attacker to execute arbitrary OS commands.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU99392903/; https://www.tp-link.com/jp/support/download/archer-ax6000/v1/#Firmware; https://jvn.jp/en/vu/JVNVU99392903/