CVE-2023-1389

This bug is like a “back door” in the router’s website. If someone reaches the router, they can trick it into running attacker commands instead of doing the harmless setting update, and those commands run with root-level power. For a business, that can mean the router is no longer trustworthy because attackers may redirect your internet traffic or keep harmful changes in place.

This matters if you use the TP-Link Archer AX21 (AX1800) router and its firmware is earlier than 1.1.4. It is a web-management problem, so the key factor is reachability: it is a risk when the vulnerable web endpoint can be accessed by an attacker (for example, over the internet) and a simple POST request is possible; KEV listing indicates real-world abuse. If your router management interface is not exposed to the internet and isn’t reachable by outsiders, the exposure is lower—but you should still update because the bug is confirmed and has a public exploit.

This is urgent because it is confirmed in the CISA Known Exploited Vulnerabilities catalog and there are public exploits available. Attackers are actively targeting router management interfaces, and the issue enables command execution as root, so successful exploitation can lead to full device control and disruption. Treat this as a “fix now” item for affected Archer AX21 routers with firmware older than 1.1.4.

Confirm exposure

• On each affected router, open the router’s web interface and look for the firmware version (commonly shown in Status or System pages), and compare it to 1.1.4.
• If you manage routers centrally, also check any router inventory/management screenshots or admin console logs for firmware versions.

Upgrade to the fixed version

• Update the TP-Link Archer AX21 (AX1800) firmware to 1.1.4 or newer (CVE-2023-1389 is fixed in 1.1.4).
• Use the vendor’s firmware download page for the Archer AX21 to obtain the correct firmware build, then install it following the vendor’s instructions.
• After upgrading, reboot the router and re-check the firmware version to confirm it actually became 1.1.4 (or higher).

If patching is delayed (temporary workaround)

• Reduce the chance attackers can reach the vulnerable web endpoint by ensuring the router’s web management interface is accessible only from your local network (LAN) and not from the public internet.
• If you use remote administration, disable it temporarily or restrict it to trusted IP addresses/VPN (so only you can reach the interface).

What to monitor

• After the update, watch for unusual router behavior (unexpected reboots, sudden loss of internet, or changed network settings).
• If you have security logging on your firewall or monitoring tools, look for repeated requests to the router’s web management endpoints around the time of any suspected scanning.

Due date guidance

• CISA KEV remediation due date for this issue was 2023-05-22; given the confirmed real-world exploitation, prioritize updating immediately for any device still on firmware older than 1.1.4.

CVE-2023-1389 is a command injection (CWE-77) in TP-Link Archer AX21 (AX1800) firmware web management handling for the “country” form used by the /cgi-bin/luci;stok=/locale endpoint. The country parameter in the write operation is not sanitized before being used in a system command execution path (described as being passed into popen()), allowing unauthenticated remote attackers to inject commands that execute with root privileges.

Exploitation status: This issue is listed in CISA KEV (added 2023-05-01) with a remediation deadline of 2023-05-22, and there is public exploit availability (weaponization) consistent with real-world risk. The traffic-light verdict is RED for this CVE, meaning it should be treated as actively exploited and prioritized.

Attack vector and requirements: An attacker can trigger the vulnerable behavior via a simple POST request to the affected endpoint; the findings explicitly call out unauthenticated access. Practically, exploitation requires network reachability to the router’s web management interface.

Fix: Firmware 1.1.4 addresses the vulnerability (versions before 1.1.4 are affected). KEV is the primary driver for urgency; EPSS prediction is not used to qualify public risk here because KEV confirms exploitation.