CVE-2024-53375

Deeper analysis

An authenticated remote code execution vulnerability affects the TP-Link Archer router series through the tmp_get_sites function in the HomeShield component. The flaw, tracked as CVE-2024-53375 and assigned CWE-78, permits command injection and remains exploitable even when HomeShield is not activated. It carries a CVSS 3.1 score of 8.0 reflecting adjacent-network access, low attack complexity, and low-privileged authentication requirements that result in full compromise of confidentiality, integrity, and availability.

An attacker who has already obtained valid credentials on the local network can invoke the vulnerable function to execute arbitrary operating-system commands on the router. Successful exploitation grants the attacker complete control over the device, enabling actions such as traffic interception, persistence, or lateral movement within the attached network.

Public proof-of-concept code and a detailed technical write-up are available at the referenced GitHub repository and accompanying blog post. The EPSS score currently stands at 0.7066 with a recorded peak of 0.7488, indicating sustained exploitation interest following disclosure.