TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form o
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 are affected through the web management interface. The fix is firmware 1.1.4 Build 20230219, which removes the vulnerable callback.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 1.1.4 Build 20230219
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The TP-Link Archer AX21 (AX1800) wireless router's web management interface contains a flaw that lets an unauthenticated attacker send a simple web request to run arbitrary commands with full administrative (root) control of the device. This could allow attackers to take complete control of the router, altering its settings, intercepting or redirecting network traffic, or using it as a foothold in the local network.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a TP-Link Archer AX21 (AX1800)
All versions prior to version 1.14 Build 20230219
References 2
tenable.com
packetstormsecurity.com
Questions about CVE-2023-1389
What does this mean?
The country parameter in the web management interface is passed to a popen() call that runs as root, which lets unauthenticated commands run on the router. The call is only reached after the country parameter is first set in an initial request.Source: tenable.com
Am I affected, and how do I check?
Firmware versions before 1.1.4 Build 20230219 of the TP-Link Archer AX21 (AX1800). To check, compare the firmware version reported by the router with 1.1.4 Build 20230219.Source: tenable.com
What should I do about it?
Upgrade to firmware 1.1.4 Build 20230219, which fixes the issue by removing the vulnerable callback.Source: tenable.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-05-01, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data