{"id":"CVE-2023-1389","aliases":["EUVD-2023-23645","GHSA-h49r-m2rg-6pgf"],"status":"published","title":"TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command...","description":"TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.99999,"percentile":0.99992,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-77"],"published":"2023-03-15T00:00:00Z","modified":"2026-06-17T05:27:50Z","kev":{"date_added":"2023-05-01","due_date":"2023-05-22","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2023-05-01"},{"source":"kev","since":"2023-05-01"}],"exploits":[{"source":"pocgithub","id":"Voyag3r-Security/CVE-2023-1389","title":"Voyag3r-Security/CVE-2023-1389","date":"2023-07-28","url":"https://github.com/Voyag3r-Security/CVE-2023-1389"},{"source":"exploitdb","id":"EDB-51677","title":"TP-Link Archer AX21 - Unauthenticated Command Injection","type":"remote","platform":"hardware","date":"2023-08-10","url":"https://www.exploit-db.com/exploits/51677"},{"source":"pocgithub","id":"werwolfz/CVE-2023-1389","title":"werwolfz/CVE-2023-1389","date":"2023-12-25","url":"https://github.com/werwolfz/CVE-2023-1389"},{"source":"nuclei","id":"CVE-2023-1389","title":"TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1389.yaml"}],"products":[{"vendor":"tp-link","product":"archer ax21"},{"vendor":"tp-link","product":"archer_ax21_firmware"}],"references":[{"url":"https://www.tenable.com/security/research/tra-2023-11","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/174131/TP-Link-Archer-AX21-Command-Injection.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-1389","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1389"},{"url":"https://github.com/advisories/GHSA-h49r-m2rg-6pgf"}],"sources":{"cve":[{"id":"CVE-2023-1389","description":"TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.","status":"published","published":"2023-03-15T00:00:00Z","modified":"2025-10-21T23:15:23.352Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:35:32.019713Z"}],"euvd":[{"id":"EUVD-2023-23645","description":"TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.","status":"published","published":"2023-03-15T00:00:00Z","modified":"2025-10-21T23:15:23Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2023-05-01","updated_at":"2026-11-02T20:31:26.48918Z"}],"ghsa":[{"id":"GHSA-h49r-m2rg-6pgf","title":"TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command...","description":"TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.","status":"published","published":"2023-03-16T00:32:43Z","modified":"2025-10-22T00:32:43Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:04:06.493434Z"}],"kev":[{"id":"CVE-2023-1389","title":"TP-Link Archer AX-21 Command Injection Vulnerability","description":"TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution.","cwes":["CWE-77"],"kev":{"date_added":"2023-05-01","due_date":"2023-05-22","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2023-1389","description":"TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.","status":"published","published":"2023-03-15T23:15:09.403Z","modified":"2026-06-17T05:27:50.687Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:07:49.031498Z"}]}}