TP-Link Archer AX-21 Command Injection Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-05-01
• EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.

CISA: TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 22 May 2023): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• packetstormsecurity.com/files/174131/TP-Link-Archer-AX21-Command-Injection.htmlExploitThird Party AdvisoryVDB Entry
• www.tenable.com/security/research/tra-2023-11ExploitThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource