Cyber Resilience

CVE-2024-5035

High

Published: 27 May 2024

Published
27 May 2024
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 8.8 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0786 92.2th percentile
Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-5035 is a high-severity Command Injection (CWE-77) vulnerability in Onekey (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 7.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

The vulnerability is an unauthenticated command injection flaw in the "rftest" network service exposed on ports TCP/8888, TCP/8889, and TCP/8890 of the TP-Link Archer C4500X router. The issue, tracked as CVE-2024-5035 and assigned CWE-77, affects all firmware versions through 1_1.1.6 and carries a CVSS 4.0 score of 8.8.

A remote attacker on the adjacent network can connect to any of the three ports and inject operating-system commands without authentication or user interaction, resulting in arbitrary command execution with elevated privileges on the device.

The referenced TP-Link advisory and firmware page for the Archer C5400X indicate that updated firmware should be applied to address the exposure, while the OneKey disclosure provides technical details on the affected service and ports. The associated EPSS score has remained flat at 0.0786 with no material increase observed since disclosure.

EU & UK References

Vulnerability details

The affected device expose a network service called "rftest" that is vulnerable to unauthenticated command injection on ports TCP/8888, TCP/8889, and TCP/8890. By successfully exploiting this flaw, remote unauthenticated attacker can gain arbitrary command execution on the device with elevated…

more

privileges.This issue affects Archer C4500X: through 1_1.1.6.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Onekey
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References