TP-Link · Archer AX21
CVE-2023-1389
TP-Link Archer AX-21 Command Injection Vulnerability
What it is
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.
CISA: TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 22, 2023
More exploited flaws from TP-Link
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 3, 2025 | Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection | Multiple Routers | High 8.6 | 38% |
| Sep 3, 2025 | Authentication Bypass by Spoofing | TL-WR841N | Medium 6.5 | 20% |
| Sep 2, 2025 | Missing Authentication for Critical Function | TL-WA855RE | High 8.8 | 22% |
| Jun 16, 2025 | Command Injection | Multiple Routers | High 8.8 | 42% |
| Mar 25, 2022 | Directory Traversal | Multiple Archer Devices | High 7.5 | 84% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.