High severity · published Dec 5, 2024
CVE-2024-54126
Insufficient Integrity Verification Vulnerability in TP-Link Archer C50
8.5
CVSS
0.1%
EPSS
No
On KEV
Description
This vulnerability exists in the TP-Link Archer C50 due to improper signature verification mechanism in the firmware upgrade process at its web interface. An attacker with administrative privileges within the router’s Wi-Fi range could exploit this vulnerability by uploading and executing malicious firmware which could lead to complete compromise of the targeted device.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Archer C50 Wireless Router · TP-Link
<Archer C50(EU)_V4_ 240917 · source: vendor
AC
Archer C50 Firmware · Tp-link
c50\(eu\)_v4_240917 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-54126
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-54126
www.cert-in.org.in
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0354
More from Archer C50 Wireless Router
4.3
CVE-2024-54127
Exposure of Wi-Fi Credentials in Plaintext in TP-Link Archer C50