CVE-2023-36489

published 2023-09-06

CVE-2023-36489: Multiple TP-LINK products allow a network-adjacent unauthenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows…

Priority P3 54 high 8.8 CVSS 3.1

AV A AC L PR N UI N S U C H I H A H

Multiple TP-LINK products allow a network-adjacent unauthenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: TL-WR802N firmware versions prior to 'TL-WR802N(JP)_V4_221008', TL-WR841N firmware versions prior to 'TL-WR841N(JP)_V14_230506', and TL-WR902AC firmware versions prior to 'TL-WR902AC(JP)_V3_230506'.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
tp-link	tl-wr802n	—	—
tp-link	tl-wr802n_firmware	< 221008	221008
tp-link	tl-wr841n	—	—
tp-link	tl-wr841n_firmware	< 230506	230506
tp-link	tl-wr902ac	—	—
tp-link	tl-wr902ac_firmware	< 230506	230506

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78