Loading vulnerability…
Unauthenticated Root Command Injection in TP-Link Archer AX21
CVE-2023-1389 is an unauthenticated operating-system command-injection vulnerability affecting TP-Link Archer AX21 (AX1800) router firmware before version 1.1.4 Build 20230219. The web management interface's locale handler fails to sanitize the country parameter during the country form's write operation before incorporating it into a popen() call. A crafted HTTP POST request can therefore execute arbitrary commands as root. The vulnerability has been actively exploited by multiple botnets, including Mirai variants, Condi, RondoDox, and ClingSTUN.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the router with root privileges, permitting unauthorized command execution, malware installation, configuration changes, and access to information available on the device. Observed exploitation has recruited vulnerable routers into botnets for DDoS attacks and deployed backdoors supporting persistent remote access and traffic proxying. A compromised router can also provide a foothold for reconnaissance or attacks against reachable internal systems.
If you can’t patch tonight, do this now.
Remove the web management interface from direct Internet exposure and restrict management access to trusted administrative hosts or a protected management network. Isolate vulnerable or unsupported routers from sensitive assets, restrict unnecessary outbound connectivity, and deploy intrusion-prevention controls for Archer AX21 command-injection attempts. Monitor for unexpected command execution, startup changes, and anomalous outbound communications. These controls reduce exposure but do not replace firmware remediation.
Patch, then assume compromise.
Upgrade affected Archer AX21 routers to firmware version 1.1.4 Build 20230219 or a later vendor-supported release appropriate to the device's hardware revision and region. Verify the installed version after updating rather than relying solely on update notifications. Replace unsupported devices when a maintained, patched firmware release is unavailable.
2 exploits validated by Mallory's analysis. Hidden: 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
84 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.