CVE-2021-42232
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
TP-Link Archer A7 router with firmware Archer A7(US)_V5_210519 is vulnerable to command injection in /usr/bin/tddp. The program incorrectly uses part of the received data packet as part of a command, allowing an attacker to execute arbitrary commands on the device.
Risk Assessment
An attacker can remotely take control of the router, modify its configuration, intercept network traffic, or use it as a pivot point for further attacks within the internal network.
Recommendation
Immediately update the TP-Link Archer A7 router firmware to the latest available version that fixes this vulnerability. If no update is available, consider temporarily disabling remote access to the administrative interface.
Original NVD description (English source)
TP-Link Archer A7 Archer A7(US)_V5_210519 is affected by a command injection vulnerability in /usr/bin/tddp. The vulnerability is caused by the program taking part of the received data packet as part of the command. This will cause an attacker to execute arbitrary commands on the router.