CVE-2023-1389 is an unauthenticated command injection in the web management interface of the TP-Link Archer AX21 (AX1800) router: the country parameter of the locale-setting API is passed unsanitized into a popen() call running as root, so a remote attacker can execute arbitrary commands with two crafted HTTP requests and no credentials — a flaw that botnet operators folded into Mirai variants within weeks of disclosure.
Vulnerability summary
8.8
High
100.0%
EPSS score (FIRST)
Yes
CISA KEV catalog
2023-03-15
Published
Vulnerability ID: CVE-2023-1389 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| TP-Link Archer AX21 (AX1800) firmware | cpe:2.3:o:tp-link:archer_ax21_firmware:*:*:*:*:*:*:*:* | All firmware versions before 1.1.4 Build 20230219 (fixed in 1.1.4 Build 20230219 or later) |
What this means
CVE-2023-1389 is a command injection vulnerability (CWE-77) in the /cgi-bin/luci;stok=/locale endpoint of the TP-Link Archer AX21 (AX1800) web management interface. Tenable's research, credited as the original find, shows the country parameter of the write operation is passed unsanitized into a popen() call that executes as root: an attacker first sends a request that stores a malicious country value (e.g. operation=write&country=$(id>/tmp/out)), then a second request that triggers it, achieving unauthenticated remote code execution (Tenable TRA-2023-11).
NVD's own analysis scores it CVSS v3.1 8.8 (high), vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — adjacent-network attack vector, low complexity, no privileges or user interaction required, full impact to confidentiality, integrity and availability; Tenable's research also notes that when chained with ZDI-23-452 (CVE-2023-27359), an SSRF-style bug, the attack vector extends from the LAN to the WAN interface without needing local network access (NVD; Tenable TRA-2023-11).
TP-Link fixed the issue in Archer AX21 firmware 1.1.4 Build 20230219 and later; all earlier firmware builds are vulnerable (NVD).
CISA added CVE-2023-1389 to the Known Exploited Vulnerabilities (KEV) catalog on 2023-05-01 with a required-action due date of 2023-05-22. Public reporting following disclosure documented the bug being folded into Mirai-family IoT botnet code, which is consistent with the router's large installed base and fully unauthenticated exploit path (CISA KEV).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.99999 (99.992th percentile) — effectively certain to be targeted by mass scanning — consistent with a flaw that remains a staple of IoT botnet code years after disclosure (FIRST EPSS).
Any Archer AX21 still on firmware older than 1.1.4 Build 20230219 should be updated immediately via TP-Link's firmware download page, and devices with remote/WAN management enabled should have it disabled unless strictly required.
Evidence
- The country parameter of the locale-setting write operation on the Archer AX21 web UI is passed unsanitized into a popen() call running as root, allowing unauthenticated command injection via two crafted HTTP requests. — Tenable TRA-2023-11
- CVSS v3.1 base score is 8.8 (high), vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, per NVD's own analysis. — NVD
- Affected: all Archer AX21 (AX1800) firmware before 1.1.4 Build 20230219, which contains the fix. — NVD
- Added to the CISA Known Exploited Vulnerabilities catalog on 2023-05-01, due date 2023-05-22. — CISA KEV
- EPSS score is 0.99999 (99.992th percentile) as of 2026-10-30. — FIRST EPSS
