CVE-2023-1389

What it actually does

The flaw is an unauthenticated command injection in the TP-Link Archer AX21 web management interface. Firmware versions before 1.1.4 Build 20230219 fail to sanitize the country parameter in the /cgi-bin/luci;stok=/locale write operation before passing it to popen(), allowing attacker-controlled shell metacharacters to be executed by the device operating system. Commands run as root, giving an attacker full control of the router, including the ability to change configuration, install malware, pivot into the local network, intercept or redirect traffic, disrupt connectivity, and persist through configuration changes if additional modifications are made.

Why it matters to the business

Successful exploitation can turn an affected router into an attacker-controlled foothold at the network edge. This can cause internet outages, data interception, DNS or traffic redirection, participation in botnets or DDoS activity, and unauthorized access paths into internal systems. The vulnerability is in CISA KEV, has active in-the-wild exploitation, and has an extremely high EPSS score, making exposed or reachable devices urgent remediation targets; the CISA remediation deadline of 2023-05-22 has already passed.

How an attack unfolds

An attacker first identifies a TP-Link Archer AX21 management interface running vulnerable firmware, typically from the local network, a misconfigured remote-management exposure, or an internet-facing administrative interface. The attacker sends a crafted unauthenticated POST request to the locale endpoint and places shell control characters in the country parameter of a write operation. Because the firmware passes that parameter to popen() without sufficient sanitization, the injected command executes as root on the router. In real-world campaigns, exploitation is commonly automated: the first command often retrieves or stages a malware binary or shell script using built-in utilities, writes it to a temporary filesystem location, marks it executable, and starts it. Once compromised, the router may join a botnet, scan for additional victims, proxy traffic, alter DNS or firewall settings, or serve as a pivot point into networks that trust the device.

How to fix it

Upgrade TP-Link Archer AX21 firmware to version 1.1.4 Build 20230219 or later. If using vendor-managed or ISP-managed firmware, obtain the corresponding patched build from the provider. Disable remote administration from the internet unless explicitly required, restrict management access to trusted administrative networks only, and block access to the management interface from guest, IoT, and untrusted segments. Change the router administrator password after patching. If compromise is suspected, perform a factory reset, install the patched firmware from a trusted source, reconfigure the device from known-good settings rather than restoring an old backup, rotate any credentials that may have traversed the device, and review DNS, port-forwarding, firewall, VPN, and remote-management settings for unauthorized changes. The supplied package metadata referencing pimcore/pimcore and commit c6c80905e58c7724c776f980570a56df7016c6d1 does not match the TP-Link Archer AX21 vulnerability described here; remediation should be based on the affected TP-Link firmware line.

How to confirm the fix worked

Confirm the router reports firmware version 1.1.4 Build 20230219 or later in the administrative interface or through vendor-supported inventory mechanisms. Verify that the management interface is not reachable from the public internet and is only accessible from approved management networks. Test network controls by attempting to reach the router web interface from untrusted VLANs, guest wireless networks, and external vantage points. Review configuration for disabled WAN-side administration, strong administrator credentials, expected DNS servers, expected port-forwarding rules, and expected firewall settings. Where authorized, run a non-destructive vulnerability check that confirms the presence or absence of the vulnerable /cgi-bin/luci;stok=/locale behavior without executing operating-system commands. For previously exposed devices, validate that no unexpected processes, startup scripts, temporary binaries, DNS changes, or firewall/NAT modifications remain after remediation.

Typical attack path

1. Discover TP-Link Archer AX21 devices with reachable web management interfaces.
2. Fingerprint the firmware or management endpoint to determine whether the device is likely running a vulnerable pre-1.1.4 Build 20230219 firmware release.
3. Send an unauthenticated crafted POST request to /cgi-bin/luci;stok=/locale using the write operation and a malicious country parameter.
4. Achieve root-level command execution through the unsanitized popen() call.
5. Download or stage malware, a shell script, or command runner using router-native tools such as BusyBox utilities.
6. Execute the payload from a writable temporary location, commonly under /tmp or /var/tmp.
7. Modify router settings, firewall rules, DNS settings, startup behavior, or process state to support botnet activity, traffic interception, persistence, or lateral movement.
8. Use the compromised router to scan, proxy, launch DDoS traffic, or access internal network resources.

How to detect it

Investigate router web access logs, syslog, firewall logs, IDS/IPS events, NetFlow, DNS telemetry, DHCP records, and upstream perimeter logs for attempts to reach /cgi-bin/luci;stok=/locale, especially POST requests containing operation=write and a country parameter with shell metacharacters such as semicolons, pipes, backticks, command substitution, redirection, or references to download utilities. Many consumer routers have limited logging, so absence of local logs is not proof of non-exploitation. Look for outbound connections from the router to unfamiliar IP addresses, especially shortly after suspicious management-interface traffic; downloads using wget, curl, tftp, ftpget, or nc; execution of files from /tmp, /var/tmp, /dev/shm, or similar writable paths; processes with names resembling Mirai/Moobot-style botnet payloads; high-rate outbound scanning on Telnet, SSH, HTTP, or router-management ports; unexpected DNS server changes; unknown port forwards; new remote-management exposure; modified firewall rules; or unexplained reboots. Where packet capture is available, search HTTP bodies for the locale endpoint and command-injection characters in the country field. In environments with network detection, correlate exploitation attempts with subsequent beaconing, DDoS traffic, or scanning behavior from the router's IP address.

• POST /cgi-bin/luci;stok=/locale
• /cgi-bin/luci;stok=/locale
• operation=write
• country=
• country=;
• country=%3B
• country=|
• country=%7C
• country=`
• country=%60
• country=$(
• country=%24%28
• country=>
• country=%3E
• country=<
• country=%3C
• wget http
• curl http
• tftp -g
• ftpget
• chmod +x /tmp
• /tmp/
• /var/tmp/
• /dev/shm/
• busybox wget
• busybox tftp
• /bin/sh -c
• dnsmasq.conf
• iptables -A
• iptables -I
• iptables -t nat
• Mirai
• Moobot
• Condi

What your security team should do

• Immediately inventory TP-Link Archer AX21 routers and identify any running firmware older than 1.1.4 Build 20230219.
• Prioritize remediation for any device with WAN-side management enabled, reachable management services from untrusted networks, or evidence of scanning against /cgi-bin/luci;stok=/locale.
• Patch or replace affected devices; if patching is not possible, disable remote management, isolate the device, and plan hardware replacement.
• Treat internet-exposed vulnerable devices as likely compromised because the vulnerability is in CISA KEV, actively exploited, and has an EPSS score near 1.0.
• For suspected compromise, factory reset and reflash patched firmware from a trusted vendor source rather than only rebooting the router.
• Rotate router administrator credentials and review DNS, firewall, port-forwarding, VPN, and remote-access settings after remediation.
• Add SIEM and IDS detections for POST requests to /cgi-bin/luci;stok=/locale with suspicious country parameter metacharacters or command-staging utilities.
• Monitor outbound traffic from routers for unusual DNS queries, high-volume scanning, DDoS-like traffic, connections to unfamiliar infrastructure, or downloads of executable content.
• Segment router management interfaces away from user, guest, IoT, and server networks.
• Because the KEV remediation deadline has passed, track remaining vulnerable devices as high-priority exceptions until remediated or removed.