CVE-2023-1389

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
n/a	TP-Link Archer AX21 (AX1800)	All versions prior to version 1.14 Build 20230219

References

http://packetstormsecurity.com/files/174131/TP-Link-Archer-AX21-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://www.tenable.com/security/research/tra-2023-11Exploit, Third Party Advisory
http://packetstormsecurity.com/files/174131/TP-Link-Archer-AX21-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://www.tenable.com/security/research/tra-2023-11Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-1389US Government Resource

Timeline

Published: Mar 15, 2023
Last modified: Jun 17, 2026
Added to CISA KEV: May 1, 2023
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-13907.5A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unkn CVE-2023-13919.8A vulnerability, which was classified as problematic, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is CVE-2023-13929.8A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this vulnerability CVE-2023-13937.8A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client explicitly destroys th CVE-2023-13949.8A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0. It has been classified as critical. This affects the function CVE-2023-13956.1A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been declared as problematic. This vulnerability affe CVE-2023-13966.1A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as problematic. This issue affec CVE-2023-13976.1A vulnerability classified as problematic has been found in SourceCodester Online Student Management System 1.0. Affected is an unknown func CVE-2023-13988.8A vulnerability classified as critical was found in XiaoBingBy TeaCMS 2.0. Affected by this vulnerability is an unknown functionality of the CVE-2023-13999.8N6854A Geolocation Server versions 2.4.2 are vulnerable to untrusted data deserialization, which may allow a malicious actor to escalate pri CVE-2023-14004.8The Modern Events Calendar Lite WordPress plugin before 6.5.2 does not sanitise and escape some of its settings, which could allow high priv CVE-2023-14014.3An issue has been discovered in GitLab DAST scanner affecting all versions starting from 3.0.29 before 4.0.5, in which the DAST scanner leak