TP-Link Archer AX-21 Command Injection Vulnerability
TP-Link · Archer AX21
The TP-Link Archer AX21 (AX1800) web management interface has a command injection flaw in the country parameter of the /cgi-bin/luci;stok=/locale endpoint in firmware before 1.1.4 Build 20230219, where unsanitized input is passed to popen(). An unauthenticated attacker on the adjacent network can exploit it with a single crafted POST request, with no user interaction, to run commands as root.
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 4/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.How attackers get in
What they do
What can follow
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 40 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 4 months after disclosure.
- Disclosedday 0
- First seen exploitedVulnCheck KEV evidence+40 days
- Added to CISA KEVEU database agrees+47 days
- Public exploit codePoC-in-GitHub+4 mo
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
5 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 5ExecutionTA0002
CVE-2023-1389 is a command injection vulnerability in one of the API components within the TP-Link Archer router’s web management interface. Public reports have reported that multiple botnet malware under the Mirai variants, including Condi, are targeting these vulnerable devices.
Stealth
ExfiltrationTA0010
ImpactTA0040
Detection
1 rule for this CVE · 55 general rules for its techniquesRules for this CVE
1Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2023-1389 directly.General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Native APIT110614 general rules
- Turla Group Named Pipescriticaltest
- BPFDoor Abnormal Process ID or Lock File Accessedhightest
- HackTool - CobaltStrike BOF Injection Patternhightest
- HackTool - HandleKatz Duplicating LSASS Handlehightest
- HackTool - RedMimicry Winnti Playbook Executionhightest
- HackTool - WinPwn Executionhightest
- HackTool - WinPwn Execution - ScriptBlockhightest
- Potential WinAPI Calls Via CommandLinehightest
Resource HijackingT149613 general rules
- Linux Crypto Mining Pool Connectionshighstable
- Monero Crypto Coin Mining Pool Lookuphighstable
- Network Communication With Crypto Mining Poolhighstable
- Potential Crypto Mining Activityhighstable
- Linux Crypto Mining Indicatorshightest
- Azure Kubernetes Network Policy Changemediumtest
- Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deletedmediumtest
- Azure Kubernetes Secret or Config Object Accessmediumtest
Indicator RemovalT107020 general rules
- Fsutil Suspicious Invocationhighstable
- Shadow Copies Deletion Using Operating Systems Utilitieshighstable
- Clearing Windows Console Historyhightest
- Disable of ETW Trace - Powershellhightest
- ETW Trace Evasion Activityhightest
- Exchange PowerShell Cmdlet History Deletedhightest
- Remove Exported Mailbox from Exchange Webserverhightest
- Sysmon Driver Unloaded Via Fltmc.EXEhightest
Exfiltration Over C2 ChannelT10415 general rules
- Equation Group C2 Communicationhightest
- OpenCanary - TFTP Requesthightest
- Shai-Hulud NPM Package Malicious Exfiltration via Curlhighexperimental
- Network Communication Initiated To Portmap.IO Domainmediumtest
- Tunneling Tool Executionmediumtest
Network Denial of ServiceT14983 general rules
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
- 44 more on OTX