CVE-2024-48288 - TP-Link TL-IPC42C V4.0_20211227_1.0.16 is vulnerable to command injection due to the lack of malicious code verification on both the frontend and backend

Back Back to CVE browser

HIGH

TP-Link TL-IPC42C V4.0_20211227_1.0.16 is vulnerable to command injection due to the lack of malicious code verification on both the frontend and backend

Published Nov 21, 2024

8.0

HIGH

CVSS 3.1

EPSS 10.94%

Description

TP-Link TL-IPC42C V4.0_20211227_1.0.16 is vulnerable to command injection due to the lack of malicious code verification on both the frontend and backend.

Affected products

Vendor TP-Link Product TL-Ipc42c Firmware Default
n/a
- Version
  1.0.06.002
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

TP-Link

TL-Ipc42c Firmware

n/a

Version	Status	Constraints
1.0.06.002	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-77

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-43172
Advisory
https://github.com/GroundCTL2MajorTom/pocs/blob/main/Cisco_Linksys_E3000_rce.md
ExploitThird Party Advisory
https://github.com/GroundCTL2MajorTom/pocs/blob/main/TP-Link_TL-IPC42C_RCE.md
ExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-43172		Advisory
https://github.com/GroundCTL2MajorTom/pocs/blob/main/Cisco_Linksys_E3000_rce.md		ExploitThird Party Advisory
https://github.com/GroundCTL2MajorTom/pocs/blob/main/TP-Link_TL-IPC42C_RCE.md		ExploitThird Party Advisory