What is CVE-2023-1389?

A high-severity vulnerability, CVE-2023-1389, has been discovered in the web management interface of TP-Link Archer AX21 (AX1800) routers with firmware versions before 1.1.4 Build 20230219. This unauthenticated command injection vulnerability allows attackers to inject commands that run as root, potentially compromising the security of affected systems. Users of TP-Link Archer AX21 routers should ensure their firmware is updated to protect against this vulnerability and maintain the security of their networks.

Who is impacted by CVE-2023-1389?

The CVE-2023-1389 vulnerability affects users of TP-Link Archer AX21 (AX1800) routers with firmware versions before 1.1.4 Build 20230219. This high-severity vulnerability can potentially compromise the security of affected systems, as it allows attackers to inject commands that run as root. It is important for users to be aware of this issue and take necessary precautions to maintain the security of their networks.

What to do if CVE-2023-1389 affected you

If you're affected by the CVE-2023-1389 vulnerability, it's crucial to take immediate action to secure your network. Follow these simple steps to mitigate the risk:

1. Update your TP-Link Archer AX21 firmware to version 1.1.4 Build 20230219 or later.

2. Restrict access to the web management interface to trusted IP addresses or networks.

3. Change the default credentials for the web management interface.

By taking these precautions, you can help protect your network from potential security threats posed by this vulnerability.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-1389 vulnerability, also known as TP-Link Archer AX-21 Command Injection Vulnerability, is indeed present in CISA's Known Exploited Vulnerabilities Catalog. It was added to the catalog on May 1, 2023, and the due date for required action is May 22, 2023. To mitigate the risk, users should apply updates per vendor instructions, which include updating the TP-Link Archer AX21 firmware to version 1.1.4 Build 20230219 or later.

CVE-2023-1389 Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-77, which refers to improper neutralization of special elements used in a command, also known as command injection.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• Packet Storm: TP-Link Archer AX21 Command Injection

• Tenable: Unauthenticated Command Injection in TP-Link Archer AX21 (AX1800)

• CISA: BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities

• CISA: Known Exploited Vulnerabilities Catalog