CVE-2023-1389

At a glance

Severity: HIGH 8.8
Exploitation: Known exploited (CISA KEV) · added 2023-05-01
Exploited per ENISA since 2023-05-01
EPSS: EPSS 100.00 % · percentile 100 (2026-10-27)
State: PUBLISHED
Published: 2023-03-15
Updated: 2025-10-21
Assigner: tenable
NVD status: Analyzed

Description

TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 8.8	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP
CVSS 3.1	HIGH 8.8	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 3.1	HIGH 8.8	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Weaknesses (CWE)

CWE-77

European references

ENISA EUVD · EUVD-2023-23645
GCVE · GCVE-0-2023-1389

Affected configurations (NVD CPE)

cpe:2.3:o:tp-link:archer_ax21_firmware:*:*:*:*:*:*:*:* < 1.1.4

Affected products

Product	Versions
TP-Link Archer AX21 (AX1800)	affected All versions prior to version 1.14 Build 20230219

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
CISA Known Exploited Vulnerabilities	CC0 1.0
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD