CVE-2023-1389

Name of the Vulnerable Software and Affected Versions TP-Link Archer AX21 versions prior to 1.1.4 Build 20230219

Description An unauthenticated attacker can execute arbitrary commands with root privileges on the web management interface via a command injection issue. The flaw exists because the country parameter in the write operation of the '/cgi-bin/luci;stok=/locale' endpoint is not sanitized before being processed by the popen() function. This allows for remote code execution through a simple POST request.

Real-world exploitation has been observed by Chinese state-linked actors and various botnets, including Mirai and Ballista. The Ballista botnet has compromised over 6,000 devices worldwide, specifically targeting sectors such as healthcare, manufacturing, and technology in countries including Brazil, Poland, Turkey, the UK, Mexico, China, Australia, and the USA. These compromised devices are used to build massive botnets for conducting DDoS attacks, including DNS reflection attacks, and establishing encrypted command-and-control channels to redirect users to phishing sites.

Recommendations Update to firmware version 1.1.4 Build 20230219 or later. As a temporary workaround, restrict access to the '/cgi-bin/luci;stok=/locale' endpoint on the web management interface to minimize the risk of exploitation.