TI-2023-20381 Aliases CVE-2023-39224 GHSA-m38f-j7hr-9hgm

OS command injection in TP-Link Archer C5

LOW 37CWE-78Published 2023-09-06 · Updated 2024-09-26

Key facts

Attack vector: Adjacent network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

Archer C5 firmware all versions and Archer C7 firmware versions prior to 'Archer C7(JP)_V2_230602' allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Note that Archer C5 is no longer supported, therefore the update for this product is not provided.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00401 34th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TP-Link	Archer C5	firmware all versions	—	No fix listed	CNA
TP-Link	Archer C7	firmware versions prior to 'Archer C7(JP)_V2_230602'	—	No fix listed	CNA

Archer C5 VendorTP-Link Affected firmware all versions Fixed in — No fix listed CNA
Archer C7 VendorTP-Link Affected firmware versions prior to 'Archer C7(JP)_V2_230602' Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:tp-link:archer_c7_firmware::::::::	before 230602	Vulnerable	TP-Link
cpe:2.3:h:tp-link:archer_c7:2.0:::::::*	2.0	Running on	TP-Link

cpe:2.3:o:tp-link:archer_c7_firmware:*:*:*:*:*:*:*:* Versions before 230602 Vulnerable ·TP-Link
cpe:2.3:h:tp-link:archer_c7:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·TP-Link

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-39224
2026-10-03 Alias added: GHSA-m38f-j7hr-9hgm

References

Advisory 1

https://jvn.jp/en/vu/JVNVU99392903/

Other 1

https://www.tp-link.com/jp/support/download/archer-c7/v2/#Firmware

TI-2025-08589 Authenticated RCE via Parental Control command injection KEVCVSS 4.0HIGH 8.6
TI-2015-02672 Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317… KEVCVSS 3.1HIGH 7.5
TI-2023-27456 Authentication bypass by spoofing in TP-Link TL-WR841N KEVCVSS 3.1MEDIUM 6.5
TI-2020-18081 A password-disclosure issue in the web interface on certain TP-Link devices allows a… CVSS 3.1CRITICAL 9.8
TI-2023-02475 TP-Link Archer C7v2 GET Request Parameter denial of service CVSS 3.1MEDIUM 6.5
TI-2026-04692 Use of weak cryptographic key in TP-Link Archer C7 CVSS 4.0MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences