CVE Feed

    Dashboard / CVE / CVE-2023-1389

    CVE-2023-1389

    TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.

    Published:Mar 15, 2023
    Last Modified:Nov 3, 2025
    EPS:Mar 15, 2023
    EPSS Score:0.93659
    CVSS Score:8.8

    CISA Notification

    Description

    TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.

    Required Action:

    Apply updates per vendor instructions.

    Notes:

    No extra notes provided.

    Due Date
    May 22, 2023
    1208 days ago
    Alert Date
    May 1, 2023
    1229 days ago

    Affected Products

    Vendor
    Tp-link
    Product
    Archer Ax21
    Vendor
    Tp-link
    Product
    Archer Ax21 Firmware

    Exploits

    http://packetstormsecurity.com/files/174131/TP-Link-Archer-AX21-Command-Injection.htmlhttps://www.tenable.com/security/research/tra-2023-11http://packetstormsecurity.com/files/174131/TP-Link-Archer-AX21-Command-Injection.htmlhttps://www.tenable.com/security/research/tra-2023-11https://www.exploit-db.com/exploits/51677https://github.com/Voyag3r-Security/CVE-2023-1389https://github.com/werwolfz/CVE-2023-1389

    Related CVEs

    CVE-2023-28760 (CVSS 7.5) — TP-Link AX1800 WiFi 6 Router (Archer AX21) devices allow unauthenticated attackers (on the LAN) to execute arb…
    CVE-2023-27359 (CVSS 8.1) — TP-Link AX1800 hotplugd Firewall Rule Race Condition Vulnerability. This vulnerability allows remote attackers…
    CVE-2023-27346 (CVSS 8.8) — TP-Link AX1800 Firmware Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerab…
    CVE-2023-27333 (CVSS 6.8) — TP-Link Archer AX21 tmpServer Command 0x422 Stack-based Buffer Overflow Remote Code Execution Vulnerability. T…
    CVE-2023-27332 (CVSS 8.8) — TP-Link Archer AX21 tdpServer Logging Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vu…
    CVE-2023-31710 (CVSS 9.8) — TP-Link Archer AX21(US)_V3_1.1.4 Build 20230219 and AX21(US)_V3.6_1.1.4 Build 20230219 are vulnerable to Buffe…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High