Unauthenticated web-management command injection

1. Summary

The web-management interface of the TP-Link Archer AX21 (AX1800) Wi-Fi router contains an unauthenticated OS command injection in its locale API endpoint [1][2]. The country parameter of a write operation is concatenated into a shell command string and executed via popen without neutralizing shell metacharacters, and the handling CGI process runs as root [2][3]. An unauthenticated attacker with network reachability to the management interface can therefore execute arbitrary commands as root on the device [1][2]. The flaw class is command injection (CWE-77) [1][6].

2. Affected products & versions

Note: TP-Link’s vendor FAQ page directs affected hardware versions (V1.2, V2, V3) to update to the latest firmware but does not itself state the specific fixed build; the 1.1.4 Build 20230219 boundary is sourced from NVD, Tenable, and the GitHub advisory rather than the vendor FAQ text [5][1][2][6].

3. The vulnerability in detail

The defect lives in the router’s LuCI-based web-management interface, specifically at the locale API exposed under the URL path /cgi-bin/luci/;stok=/locale [2][3]. This endpoint accepts form-style operations, and among them is a write operation against the country field — the setting that would normally control the device’s regulatory/locale configuration. Under normal operation the router uses this value to select a country-appropriate configuration profile. The bug is that the attacker-controlled country string is trusted as data-that-is-only-ever-a-country-code, when in fact it is fed into a shell [2][3].

The root cause is a classic unsanitized shell concatenation. Per ZDI’s analysis of the vulnerable code path, the request routes into a set_country function, which calls merge_config_by_country, which builds a command string by concatenating the attacker-supplied country value directly into it and then hands that string to popen [3]. popen runs its argument through /bin/sh -c, so any shell metacharacters in the country value — command substitution $(...), backticks, ;, |, &&, redirection — are interpreted by the shell rather than treated as literal text [2][3]. There is no allow-listing of the value to a known country-code set, no escaping, and no neutralization of special elements before the string reaches the shell. This is precisely CWE-77 (Improper Neutralization of Special Elements used in a Command / “Command Injection”): the program constructs all or part of a command using externally influenced input but fails to neutralize the elements that could modify the intended command [1][6]. Because the CGI handler process that executes this path is running with root privilege, the injected command inherits root — the injection is not merely “run a command” but “run a command as the most privileged user on the device” [2][3].

A notable and easily-missed part of the mechanism is that exploitation is a two-request sequence, not a single self-contained request [2]. The first request performs the write: it POSTs to /cgi-bin/luci/;stok=/locale?form=country with operation=write and a country value carrying the payload (e.g. country=$(<shell payload>)). This stores the malicious payload as the persisted country value. A second request to the country endpoint then causes the previously stored payload to be concatenated into the command string and executed via popen as root [2]. In other words, the “set” and the “trigger” are decoupled: you plant the payload, then you fire it. No authentication is required at any point in this sequence [1][2].

Preconditions are modest. The device must be running affected firmware (before 1.1.4 Build 20230219) [1][6], and the attacker must have network reachability to the management interface. NVD scores the attack vector as Adjacent (AV:A) — i.e. the interface is reachable from the LAN / adjacent network by default, not the open Internet [1]. However, ZDI documented that a separate iptables race condition (found by Qrious Security at Pwn2Own) can briefly expose the vulnerable functionality on the WAN side; when that race is chained with the command injection, WAN-side exploitation becomes possible [3]. Tenable’s own public disclosure demonstrated only the LAN/adjacent-side path and did not demonstrate WAN-side exploitability [2][3].

The full exploitation chain, end to end, is:

1. Reach the router web-management interface at /cgi-bin/luci/;stok=/locale over the adjacent/LAN network — or over the WAN if the iptables race-condition exposure is chained per ZDI [2][3].
2. Send an unauthenticated POST to /cgi-bin/luci/;stok=/locale?form=country with operation=write and country=$(<shell payload>), storing the payload (request 1) [2].
3. Send a second request to the country endpoint, causing the stored payload to be concatenated and executed via popen as root (request 2) [2].
4. The injected command runs as root — in the observed attacks, this fetches and executes an architecture-specific Mirai binary from a C2 server [3].
5. The infected device establishes C2 and joins the botnet, where it can be directed to conduct DDoS attacks, including TSource Engine Query (VSE) floods [3].

Proof-of-concept status is the most severe category: exploited in the wild and weaponized. A public PoC exists (Exploit-DB EDB-51677, by “Voyag3r”, published August 2023) demonstrating unauthenticated root RCE via the country parameter using the two-request mechanic [7]. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2023-05-01 [1][4]. ZDI and Trend Micro documented in-the-wild Mirai variant exploitation beginning around April 11, 2023 [3][8], and Fortinet reported continued exploitation by multiple botnet families beyond the initial Mirai campaign [9].

4. Discovery & timeline

The vulnerability was discovered at Pwn2Own Toronto 2022 (December 6, 2022) [2][3]. At the event, Team Viettel targeted the LAN-side interface and Qrious Security exploited the WAN-side via the iptables race condition [3]. It was publicly disclosed and credited by Tenable researchers Jimi Sebree and Evan Grant in advisory TRA-2023-11 [2]. ZDI tracked it as ZDI-CAN-19557 / ZDI-23-451 [3].

Timeline [2][3][4][10]:

• Dec 6, 2022 — discovered at Pwn2Own Toronto.
• Jan 2023 — publicly reported [10].
• Mid-March 2023 — TP-Link firmware fix released; Tenable advisory published Mar 14, 2023; ZDI cites Mar 17, 2023 firmware [2][3].
• ~Apr 11, 2023 — in-the-wild Mirai exploitation begins [3][8].
• Apr 21/24, 2023 — ZDI/Tenable publish WAN-side/Mirai analysis [3].
• May 1, 2023 — added to CISA KEV, with a May 22, 2023 remediation due date [1][4].

An incomplete Feb 24 fix additionally preceded the March firmware; this pre-March step is not reflected in the primary vendor advisories [10].

5. Technical reference

• CVE: CVE-2023-1389 [1].
• CWE: CWE-77 — Improper Neutralization of Special Elements used in a Command (“Command Injection”) [1][6].
• CVSS v3.1: base score 8.8 (HIGH), vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [1]. Reading the key metrics for this bug: AV:A (Adjacent) — the management interface is reachable from the adjacent/LAN network by default rather than the open Internet (WAN reach requires chaining the iptables race per ZDI [3]); AC:L / PR:N / UI:N — low complexity, no privileges, no user interaction, i.e. a direct unauthenticated primitive; S:U — scope unchanged (the CVSS scope metric does not credit the fleet-scale botnet consequence, one reason CVSS understates real-world impact here); C:H/I:H/A:H — full compromise of confidentiality, integrity, and availability on the device, consistent with root code execution.
• Code/commit refs: no public source commit; the vulnerable path per ZDI is set_country → merge_config_by_country → popen, with the fix removing the vulnerable callback per Tenable [2][3]. Advisory IDs: TRA-2023-11 (Tenable), ZDI-CAN-19557 / ZDI-23-451, GHSA-h49r-m2rg-6pgf [2][3][6]. Public PoC: Exploit-DB EDB-51677 [7].

6. Consequence & CFSE path analysis

Real-world consequence: a single unauthenticated command-injection primitive yields root on the gateway. That root foothold has three concrete consequences: (a) an attacker gains full administrative control of the device’s routing, DNS, and command surface; (b) at population scale, the reusable remote-root exploit lets attackers mass-enroll exposed devices into a botnet and command them (this is exactly what Mirai and follow-on botnets did) [3][8][9]; and (c) as router-root, the attacker can intercept, redirect, or manipulate all downstream client traffic (DNS hijack / MITM). Recovery is not a config toggle — it requires per-device firmware patching (or replacement) across a large, dispersed population [5].

Why the CFSE Path Score diverges from CVSS: CVSS gives 8.8 HIGH and, via S:U, explicitly declines to credit anything beyond the single device. CFSE decomposes the same primitive into distinct consequence paths and scores each on exposure, cross-domain bridging, and fleet-scale reuse — which is precisely where this bug’s true severity lives. The exploit is a reusable, weaponized remote-root primitive that was executed at Internet scale by Mirai, so the systemic (fleet) dimension dominates. That is what lifts two paths from a CRITICAL base band to EMERGENCY, a distinction CVSS’s per-instance model cannot express.

CFSE verdict: EMERGENCY.

The entry decomposes CVE-2023-1389 into three consequence paths from a single unauthenticated command-injection primitive on the Archer AX21 web-management interface. Two co-dominant paths are banded EMERGENCY: ACCOUNT_AUTHORITY (root administration of the gateway’s routing, DNS, and command surface) and FLEET_CONTROL_PLANE (mass botnet command-and-control over a large exposed population). Both start from a CRITICAL base band and are uplifted to EMERGENCY because the reusable remote-root exploit was weaponized by Mirai at Internet scale and recovery demands coordinated per-device patching or replacement. A third supporting path, DATA_PRIVACY (traffic interception / DNS hijack / MITM against all downstream clients), stays at CRITICAL under a privacy-only cap. Every path scores maximal exposure (RE:4, EC:4, EX:4), cross-domain bridging (CH:4), and fleet-scale reuse/execution (SR:4, SX:4), with authority capped at AT:3 (device root, not a signing/OTA trust root) and no direct physical actuation (PH:2). The overall path_verdict is EMERGENCY, driven by the two co-dominant authority and systemic paths.

Two CFSE metric notes: the EC:4 rung is described as “Metasploit-available”, but public sources confirm only a public Exploit-DB PoC — the public-PoC basis for EC:4 holds; the Metasploit basis does not [7]. Authority is correctly capped at AT:3: the attacker gets device root, not the firmware signing / OTA trust root, so this cannot silently poison the update channel for the fleet.

7. Remediation & mitigations

• Apply the fixed firmware. Update to 1.1.4 Build 20230219 or later; TP-Link explicitly directs affected hardware versions (V1.2, V2, V3) to update to the latest firmware [1][2][5]. Per Tenable, the fix removed the vulnerable callback, so patching eliminates the injection path rather than merely filtering it [2].
• Do not expose web management to the WAN. Because WAN-side reach depends on the iptables race exposure documented by ZDI, ensure remote/WAN management is disabled and the management interface is not reachable from untrusted networks until patched [3].
• Segment untrusted-adjacent access. The default attack vector is Adjacent (LAN/adjacent network); restrict who can reach /cgi-bin/luci/;stok=/locale — e.g. isolate the router management plane from guest/IoT segments — as an interim control on unpatched devices [1][2].
• Detection specific to this bug: watch for POSTs to /cgi-bin/luci/;stok=/locale?form=country carrying operation=write with shell metacharacters ($(, backticks, ;, |) in the country value, and for outbound fetches of architecture-specific ELF binaries from the router immediately following such requests (the Mirai stage-1 pull) [2][3].
• Fleet reality: because recovery is per-device across a large exposed population, treat firmware rollout as the primary control; devices already compromised should be assumed to have run attacker code as root and should be factory-reset and re-flashed, not merely patched [5].

8. Sources

[1] CVE-2023-1389 Detail — NVD / NIST — https://nvd.nist.gov/vuln/detail/CVE-2023-1389 — authoritative CVE record: CVSS 3.1 8.8 (AV:A) vector, affected firmware boundary, CWE, KEV-add corroboration via references. — primary-advisory. [2] Unauthenticated Command Injection in TP-Link Archer AX21 (TRA-2023-11) — Tenable — https://www.tenable.com/security/research/tra-2023-11 — original discoverer writeup (Sebree, Grant): the locale endpoint, unsanitized country write callback into popen as root, and the two-request mechanic. — researcher-primary. [3] TP-Link WAN-side Vulnerability CVE-2023-1389 Added to the Mirai Botnet Arsenal — Trend Micro Zero Day Initiative (ZDI) — https://www.thezdi.com/blog/2023/4/21/tp-link-wan-side-vulnerability-cve-2023-1389-added-to-the-mirai-botnet-arsenal — vulnerable function chain (set_country→merge_config_by_country→popen), Pwn2Own origin, iptables WAN race, in-the-wild Mirai/DDoS behavior. — researcher-primary. [4] CISA Adds Three Known Exploited Vulnerabilities to Catalog — CISA — https://www.cisa.gov/news-events/alerts/2023/05/01/cisa-adds-three-known-exploited-vulnerabilities-catalog — authoritative active-exploitation confirmation: KEV add 2023-05-01, due 2023-05-22. — primary-advisory. [5] Statement on Archer AX21 Remote Code Execution Vulnerability (CVE-2023-1389) — TP-Link — https://www.tp-link.com/us/support/faq/3643/ — vendor advisory acknowledging the RCE / Mirai enrollment and directing V1.2/V2/V3 to updated firmware. — primary-advisory. [6] CVE-2023-1389 GitHub Advisory (GHSA-h49r-m2rg-6pgf) — GitHub Advisory Database — https://github.com/advisories/GHSA-h49r-m2rg-6pgf — consolidated record restating CWE-77, the affected boundary, and the country/write/popen root cause. — primary-advisory. [7] TP-Link Archer AX21 - Unauthenticated Command Injection (EDB 51677) — Exploit-DB / OffSec — https://www.exploit-db.com/exploits/51677 — public PoC achieving unauthenticated root RCE via country=$(...) two-request mechanic; no Metasploit reference. — community-poc. [8] TP-Link WAN-side Vulnerability CVE-2023-1389 Added to the Mirai Botnet Arsenal — Trend Micro — https://www.trendmicro.com/es_mx/research/23/d/tp-link-wan-side-vulnerability.html — corroborates WAN-side exploitation and fleet-scale Mirai enrollment. — reputable-press. [9] Botnets Continue Exploiting CVE-2023-1389 for Wide-Scale Spread — Fortinet FortiGuard Labs — https://www.fortinet.com/blog/threat-research/botnets-continue-exploiting-cve-2023-1389-for-wide-scale-spread — ongoing multi-botnet exploitation telemetry beyond initial Mirai. — reputable-press. [10] TP-Link Archer WiFi router flaw exploited by Mirai malware — BleepingComputer — https://www.bleepingcomputer.com/news/security/tp-link-archer-wifi-router-flaw-exploited-by-mirai-malware/ — press summary of disclosure timeline (Jan 2023 report, incomplete Feb 24 fix, March firmware) and Mirai campaign. — reputable-press.