CVE-2023-1389
TP-Link Archer AX-21 Command Injection Vulnerability
Description
CVE-2023-1389 is a high-severity command injection vulnerability in the TP-Link Archer AX21 (AX1800) wireless router, affecting firmware versions prior to 1.1.4 Build 20230219. The vulnerability exists in the country form of the web management interface's locale endpoint, where the country parameter is passed unsanitized to a popen() call, allowing an unauthenticated attacker on the adjacent network to inject arbitrary commands that execute as root. CISA has confirmed active exploitation in the wild, and with an EPSS score of 93.6% (99.8th percentile), exploitation is near-certain. Public exploit code is readily available, making firmware updates critical for all TP-Link Archer AX21 owners.
KEV Information
CVSS Score
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| tp-link | archer ax21 firmware | < 1.1.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/174131/TP-Link-Archer-AX21-Command-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.tenable.com/security/research/tra-2023-11(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-1389(US Government Resource)
Weakness Type
CWE-77: Improper Neutralization of Special Elements Used in a Command (Command Injection)
CVE-2023-1389 is classified as a command injection vulnerability (CWE-77), where the TP-Link Archer AX21 firmware fails to properly sanitize user-supplied input in the country parameter before passing it to a system command execution function (popen()). This allows an attacker to inject additional OS commands that are executed by the router's underlying operating system with root privileges.
Learn more: CWE-77 — Improper Neutralization of Special Elements Used in a Command
Impact Analysis
CVE-2023-1389 carries a CVSS 3.1 base score of 8.8 (HIGH) with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Attack Vector (Adjacent Network): the vulnerability is exploitable from the local network segment, meaning an attacker must have network adjacency to the router — this includes anyone connected to the same Wi-Fi network or LAN. Attack Complexity (Low): exploitation requires no special conditions, race windows, or custom configuration — a simple POST request to the vulnerable endpoint is sufficient. Privileges Required (None): no authentication is needed to exploit the vulnerability, as the affected endpoint does not require prior login. User Interaction (None): the attack proceeds entirely without any victim action. Confidentiality, Integrity, and Availability (all High): successful command injection as root grants the attacker complete control over the router, including the ability to intercept all network traffic, modify DNS settings for man-in-the-middle attacks, pivot into the internal network, install persistent firmware backdoors, and render the device inoperable. For home and small business environments, compromise of the router effectively compromises the entire network perimeter.
Exploit Maturity
Public exploit code is available for CVE-2023-1389 via Packet Storm Security and a detailed technical write-up with proof-of-concept was published by Tenable Research. CISA has confirmed active exploitation in the wild by adding this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 22, 2023. The EPSS score of 93.6% (99.8th percentile) indicates near-certain exploitation activity, consistent with the vulnerability being actively used in botnet recruitment campaigns targeting consumer and small-business routers. While the ransomware usage status is listed as unknown, the combination of unauthenticated command injection as root, multiple public exploits, and confirmed active exploitation demands immediate firmware updates.
Remediation
- Update TP-Link Archer AX21 firmware immediately: Upgrade to firmware version 1.1.4 Build 20230219 or later, which patches the command injection vulnerability in the locale endpoint. Download the update from TP-Link's official support page for the Archer AX21.
- Apply mitigations per CISA KEV guidance: Per the KEV required action, apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. The CISA remediation deadline was May 22, 2023.
- Disable remote management: If firmware updates cannot be applied immediately, ensure that the web management interface is not exposed to untrusted network segments and disable any remote management features that could extend the attack surface beyond the local network.
- Segment the network: Place IoT and networking devices on isolated VLANs to limit the blast radius in case of router compromise, preventing lateral movement to critical systems.
- Monitor for indicators of compromise: Check router logs for unexpected POST requests to the /cgi-bin/luci endpoint, unusual outbound connections to known botnet command-and-control servers, and unexplained configuration changes such as modified DNS settings.
Technical Details
CVE-2023-1389 is a command injection vulnerability (CWE-77) in the TP-Link Archer AX21 (AX1800) firmware's web management interface. The vulnerable endpoint is /cgi-bin/luci;stok=/locale, which processes country selection through its write operation. Root cause: the country parameter submitted via POST request is passed directly to a popen() system call without any input sanitization, escaping, or validation. This means an attacker can append shell metacharacters (such as semicolons, pipes, or backticks) followed by arbitrary OS commands to the country parameter value. Execution context: because the web management interface runs as root on the router's embedded Linux operating system, all injected commands execute with the highest privilege level, granting complete system control. Attack scenario: an unauthenticated attacker connected to the same network as the TP-Link router sends a crafted POST request to the locale endpoint with a malicious country parameter. The popen() function executes the attacker's payload as root, enabling actions such as downloading and executing additional malware, modifying routing tables and DNS configurations, exfiltrating network traffic, or bricking the device. CVSS vector context: the adjacent network attack vector (AV:A) means the attacker must be on the same network segment, but the lack of authentication (PR:N), low complexity (AC:L), and root-level execution make this trivially exploitable for anyone with Wi-Fi access to the target network.
Frequently Asked Questions
Is CVE-2023-1389 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2023-1389 and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 22, 2023. The EPSS score of 93.6% (99.8th percentile) indicates near-certain exploitation activity. Public exploit code is available from multiple sources including Packet Storm Security and Tenable Research.
What products are affected by CVE-2023-1389?
CVE-2023-1389 affects the TP-Link Archer AX21 (AX1800) wireless router running firmware versions prior to 1.1.4 Build 20230219. Only the Archer AX21 model has been confirmed as affected. Users should verify their firmware version through the router's web management interface.
How do I fix CVE-2023-1389?
Update the TP-Link Archer AX21 firmware to version 1.1.4 Build 20230219 or later, available from TP-Link's official support page. If immediate updating is not possible, restrict access to the web management interface and disable remote management features. See the Remediation section for additional hardening measures.
How severe is CVE-2023-1389?
CVE-2023-1389 is rated HIGH with a CVSS 3.1 base score of 8.8. The vulnerability allows unauthenticated command injection as root from the adjacent network, granting complete control of the router. The EPSS score of 93.6% (99.8th percentile) and confirmed active exploitation make this a critical priority for remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.