CVE-2023-1389

Published Mar 15, 2023

Last updated 14 days ago

TP-Link

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2023-1389 is an unauthenticated command injection vulnerability found in the TP-Link Archer AX21 (AX1800) Wi-Fi router. The vulnerability exists in firmware versions prior to 1.1.4 Build 20230219. Exploitation is possible via a crafted POST request to the router's web management interface. Specifically, the vulnerability lies within the "country" parameter of a form accessible at the /cgi-bin/luci/;stok=/locale endpoint. Due to a lack of proper input sanitization, an attacker can inject arbitrary commands that are executed with root privileges via the `popen()` function. This allows an attacker to gain full control of the affected device. The vulnerability was initially used in a Pwn2Own competition in December 2022. It was later independently discovered by other researchers and publicly disclosed. TP-Link has released firmware version 1.1.4 Build 20230219 to address this issue. Despite the availability of a patch, the vulnerability continues to be actively exploited in the wild by various botnets, including Mirai, Moobot, AGoent, and Gafgyt. It is crucial for users of the affected router model to update their firmware to the latest version to mitigate the risk associated with this vulnerability.

Description: TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.
Source: vulnreport@tenable.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: TP-Link Archer AX-21 Command Injection Vulnerability
Exploit added on: May 1, 2023
Exploit action due: May 22, 2023
Required action: Apply updates per vendor instructions.

Weaknesses

nvd@nist.gov: CWE-77
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-77

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:tp-link:archer_ax21_firmware:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E2DBA0CE-1871-4B4E-BCBD-3693E61DF23E",
            "versionEndExcluding": "1.1.4"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:tp-link:archer_ax21:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "2DF5A235-4531-4F03-882C-C2A6B6D07A5D"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]