Description
A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v2, v3, and v5 due to improper neutralization of user-controlled input within the web management interface. An authenticated attacker with administrative privileges may be able to execute arbitrary commands when applying configuration changes.Successful exploitation may result in a full compromise of confidentiality, integrity, and availability of the affected device.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TP-Link Systems | Archer MR600 v5 | < EU_V5_1.7.0 0.9.1 260518 rel67803, < JP_V5_1.2.0 0.9.1 260519 rel52362 | EU_V5_1.7.0 0.9.1 260518 rel67803 |
| TP-Link Systems | Archer MR600 v2 | < 1.12.0 Build 260826 | 1.12.0 Build 260826 |
| TP-Link Systems | Archer MR600 v3 | < 1.4.0 Build 260827 | 1.4.0 Build 260827 |
References
- https://www.tp-link.com/en/support/download/archer-mr600/v5/#Firmware patch
- https://www.tp-link.com/jp/support/download/archer-mr600/v5/#Firmware patch
- https://www.tp-link.com/us/support/faq/5122/ vendor-advisory
- https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware patch
- https://www.tp-link.com/en/support/download/archer-mr600/v3/#Firmware patch