CVE-2023-32619 Hardcoded credentials in Archer C50
Hard-coded credentials in TP-Link Archer C50 and C55 routers allow network-adjacent attackers to execute arbitrary OS commands.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-32619?
CVE-2023-32619 is a high-severity vulnerability in TP-LINK Archer C50, published on 6 Sep 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Archer C50 firmware versions prior to 'Archer C50(JP)_V3_230505' and Archer C55 firmware versions prior to 'Archer C55(JP)_V1_230506' use hard-coded credentials to login to the affected device, which may allow a network-adjacent unauthenticated attacker to execute an arbitrary OS command.
Weakness: CWE-798
Which versions are affected by CVE-2023-32619?
It affects 2 products.
Products include Tp-Link Archer C50 V3 Firmware, Tp-Link Archer C55 Firmware.
How do I fix CVE-2023-32619?
No fix has been published for CVE-2023-32619 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-32619 being exploited?
There is no known exploitation of CVE-2023-32619 in the wild and no public exploit code.
Other vulnerabilities in TP-LINK Archer C50
Sources
Also known as GHSA-348j-ghgq-g3hj.