CVE-2023-1389
HighExploitedPublic exploitTP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface.
Published Mar 16, 2023 · Updated Oct 21, 2025 · Also known as TR-23-0153
Key Facts
Patch immediately- CVE-2023-1389 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Archer Ax21 Firmware (Tp-Link), TP-Link Archer AX21 (AX1800).
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Apr 12, 2023. Public exploit code is available.
- EPSS estimates a 100% probability of exploitation in the next 30 days.
- Fixed versions are available, including Archer Ax21 Firmware 1.1.4.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
8.8
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
100%
Higher than 99.9% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2023-1389 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | May 1, 2023 | May 22, 2023 | Not reported |
| Industry KEV feed | Apr 12, 2023 | May 22, 2023 | Not reported |
| CIRCL KEV | May 1, 2023 | May 22, 2023 | Not reported |
| ENISA EUVD | May 1, 2023 | n/a | Not reported |
Required action: Apply updates per vendor instructions.
Affected Products
2 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Archer Ax21 FirmwareTp-Link | See advisory | 1.1.4 |
| TP-Link Archer AX21 (AX1800) | >= All versions prior to version 1.14 Build 20230219 | n/a |
Patched Releases
Archer Ax21 Firmware
1.1.4
Timeline
Publicly disclosed
Mar 16, 2023
Added to Industry KEV feed
Apr 12, 2023
Added to CISA KEV
May 1, 2023
Added to CIRCL KEV
May 1, 2023
Added to ENISA EUVD
May 1, 2023
Last updated
Oct 21, 2025
Weakness Type
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
References
- advisoryhttps://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-1389
- advisoryhttps://www.tenable.com/security/research/tra-2023-11
- advisoryUSOM advisory
- exploithttp://packetstormsecurity.com/files/174131/TP-Link-Archer-AX21-Command-Injection.html
- exploitVulnCheck exploitation report
FAQ
Common Questions.
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface.
Affected: Archer Ax21 Firmware (Tp-Link); TP-Link Archer AX21 (AX1800) versions >= All versions prior to version 1.14 Build 20230219. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Apr 12, 2023.
Yes. It was added on May 1, 2023 with a federal remediation due date of May 22, 2023.
Public exploit code is available.
Fixed versions are available, including Archer Ax21 Firmware 1.1.4.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2023-1389 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo