Live › vulnerability › CVE-2023-1389
Go to dashboardTP-Link Archer AX-21 routers contain a command injection flaw that lets remote attackers run code on the device. CISA lists it as actively exploited in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| TP-Link Archer AX21 | vendor | – | – |
| tp-link archer ax21 firmware | vendor | < 1.1.4 | 1.1.4 |
Unknown from the sources.
Apply the vendor firmware update per TP-Link instructions (CISA required action); exact fixed version is unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.
This page as .md · .json · in your agent: get_signal("CVE-2023-1389")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.