Command Injection Vulnerability in TP-Link Archer AX21 (AX1800) Firmware

CVE-2023-1389

8.8HIGH

Key Information

Vendor: Tp-link
Status: TP-Link Archer AX21 (AX1800)
Vendor: CVE Published:; 15 March 2023

Badges

👾 Exploit Exists🔴 Public PoC📰 News Worthy

Summary

The vulnerability CVE-2023-1389 is a high-severity unauthenticated command injection issue in the TP-Link Archer AX21 (AX1800) routers, which allows attackers to inject commands and ultimately gain root access to the affected devices. This vulnerability has been actively exploited by at least six distinct botnet malware operations, including AGoent, Gafgyt Variant, Moobot, Mirai Variant, Miori, and Condi. These botnets utilize different methods to exploit the vulnerability, establish control over compromised devices, and engage in malicious activities such as DDoS attacks. Despite TP-Link addressing the problem with firmware updates, a significant number of users continue to use outdated firmware, highlighting the importance of timely patching and robust security measures. Users are strongly advised to update their devices as soon as possible to mitigate the risk of compromise.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2023-1389 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply updates per vendor instructions.

Affected Version(s)

TP-Link Archer AX21 (AX1800) = All versions prior to version 1.14 Build 20230219

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-1389
Created by Terminal1337

CVE-2023-1389
Created by Voyag3r-Security

News Articles

The Record by Recorded Future

CVE-2023-1389

Botnets continue exploiting year-old flaw in unpatched TP-Link routers

The bug affects the the Archer AX21, a popular router model manufactured by TP-Link.

8 months ago

BleepingComputer

CVE-2023-1389

Multiple botnets exploiting one-year-old TP-Link flaw to hack routers

At least six distinct botnet malware operations are hunting for TP-Link Archer AX21 (AX1800) routers vulnerable to a command injection security issue reported and addressed last year.

8 months ago