Actively exploited · Published Mar 15, 2023 · Assigned by tenable
CVE-2023-1389
High 8.8 Exploited
In plain English
A high-severity command injection in TP-Link Archer AX21 (AX1800). Attackers are actively exploiting it in the wild (listed by CISA on May 1, 2023). The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 22, 2023.
Official description
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | TP-Link Archer AX21 (AX1800) | All versions prior to version 1.14 Build 20230219 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H