{"id":"CVE-2023-1389","kind":"vulnerability","aliases":["CVE-2023-1389"],"related":[],"title":"tp-link archer ax21 firmware: TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection…","description":"TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.","summary":"TP-Link Archer AX-21 routers contain a command injection flaw that lets remote attackers run code on the device. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2023-05-01T00:00:00+00:00","products":[{"name":"TP-Link Archer AX21","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link archer ax21 firmware","fixed":["1.1.4"],"affected":"< 1.1.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["archer-ax21","exploited","home-router","infrastructure","small-office-router","tp-link"],"not_affected_if":["not-archer-ax21"],"how_to_check":null,"fix":"Apply the vendor firmware update per TP-Link instructions (CISA required action); exact fixed version is unknown from the sources.","status":"open","published_at":"2023-03-15T23:15:09+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:06:51+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:06:51Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor firmware update per TP-Link instructions (CISA required action); exact fixed version is unknown from the sources.","reach":"unknown","impact":"high","summary":"TP-Link Archer AX-21 routers contain a command injection flaw that lets remote attackers run code on the device. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["tp-link","archer-ax21","home-router","small-office-router"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands on the router remotely.","analyst_note":"Find the affected and fixed firmware versions and the attack vector from TP-Link's advisory or the CISA KEV entry; the sources do not say whether the flaw is reachable from the WAN or LAN.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-archer-ax21"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00046,"input_tokens":2781,"output_tokens":363,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1389':25A,28A '-2023':24A,27A '-21':60B '/cgi-bin/luci':108C '/locale':110C '1.1.4':16A,94C '20230219':18A,96C 'activ':80B 'allow':136C 'archer':4A,10A,32A,37A,41B,58B,88C 'archer-ax21':40B 'attack':70B,139C 'ax':59B 'ax1800':12A,90C 'ax21':5A,11A,33A,38A,42B,89C 'build':17A,95C 'call':133C 'cisa':76B 'code':72B 'command':21A,64B,99C,142C 'contain':19A,62B,97C 'countri':104C,119C 'cve':23A,26A 'devic':75B 'endpoint':111C 'exploit':43B,81B 'firmwar':6A,13A,91C 'firmware':39A 'flaw':66B 'form':105C 'home':45B 'home-rout':44B 'infrastructur':47B 'inject':22A,65B,100C,141C 'interfac':116C 'let':68B 'link':3A,9A,31A,36A,54B,57B,87C 'list':77B 'manag':115C 'offic':50B 'oper':124C 'paramet':120C 'popen':135C 'post':152C 'remot':69B 'request':153C 'root':148C 'router':46B,51B,61B 'run':71B,146C 'sanit':127C 'simpl':151C 'small':49B 'small-office-rout':48B 'specif':117C 'stok':109C 'tp':2A,8A,30A,35A,53B,56B,86C 'tp-link':1A,7A,29A,34A,52B,55B,85C 'unauthent':138C 'use':130C 'version':14A,92C 'vulner':101C 'web':114C 'wild':84B 'would':144C 'write':123C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-03-15T23:15:09+00:00","kev":{"dateAdded":"2023-05-01","dueDate":"2023-05-22","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-1389","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-1389","severity":null,"published_at":"2023-05-01T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T14:39:39+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-1389","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1389","severity":null,"published_at":"2023-03-15T23:15:09+00:00","modified_at":"2026-06-17T05:27:50+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}