CVE-2023-1389
Description
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.
Summary dbcve.org
Unauthenticated command injection in TP-Link Archer AX21 router web management interface. The vulnerability exists in the country parameter of the /cgi-bin/luci;stok=/locale endpoint's write operation, where unsanitized input is passed to popen(), allowing arbitrary command execution as root via simple POST request.
Mitigation
Apply TP-Link firmware version 1.1.4 Build 20230219 or later to patch the vulnerability. If immediate patching is not possible, restrict web management interface access to trusted IPs or disable remote management entirely.