CVE-2023-1389
Published on: Not Yet Published
Last Modified on: 03/21/2023 07:31:00 PM UTC
Certain versions of Archer Ax21 from Tp-link contain the following vulnerability:
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.
- CVE-2023-1389 has been assigned by
[email protected] to track the vulnerability - currently rated as HIGH severity.
CVSS3 Score: 8.8 - HIGH
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| ADJACENT_NETWORK | LOW | NONE | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | HIGH | HIGH | HIGH |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| Unauthenticated Command Injection in TP-Link Archer AX21 (AX1800) - Research Advisory | Tenable® | www.tenable.com text/html |
MISC www.tenable.com/security/research/tra-2023-11 |
Related QID Numbers
- 730796 TP-Link Archer AX21 (AX1800) Unauthenticated Command Injection Vulnerability
Exploit/POC from Github
Zero day exploit that abuses a remote code execution vulnerability in Discord send_emoji API call.
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware
| Tp-link | Archer Ax21 | - | All | All | All |
| Operating System | Tp-link | Archer Ax21 Firmware | All | All | All | All |
- cpe:2.3:h:tp-link:archer_ax21:-:*:*:*:*:*:*:*:
- cpe:2.3:o:tp-link:archer_ax21_firmware:*:*:*:*:*:*:*:*:
No vendor comments have been submitted for this CVE
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 @cyber_advising |
CVE-2023-1389: unauthenticated command injection in the web management interface of the TP-Link Archer AX21 (AX1800… twitter.com/i/web/status/1… | 2023-03-15 12:56:53 |
| @CVEreport |
CVE-2023-1389 : TP-Link Archer AX21 AX1800 firmware versions before 1.1.4 Build 20230219 contained a command inje… twitter.com/i/web/status/1… | 2023-03-15 23:05:45 |
| @Robo_Alerts |
Potentially Critical CVE Detected! CVE-2023-1389 TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build… twitter.com/i/web/status/1… | 2023-03-15 23:56:00 |
 /r/netcve |
CVE-2023-1389 | 2023-03-16 00:38:16 |
| /r/ReverseEngineering |
TP-Link WAN-side Vulnerability CVE-2023-1389 Added to the Mirai Botnet Arsenal | 2023-04-24 15:16:49 |
| /r/blueteamsec |
TP-Link WAN-side Vulnerability CVE-2023-1389 Added to the Mirai Botnet Arsenal | 2023-04-26 18:36:56 |
| /r/cybersecurity |
Alert: Active Exploitation of TP-Link, Apache, and Oracle Vulnerabilities Detected | 2023-05-03 20:48:03 |
| /r/spixnet_gmbh_official |
TP-Link Archer WiFi router flaw exploited by Mirai malware | 2023-05-11 04:32:55 |