Advisory Details

April 24th, 2023

(Pwn2Own) TP-Link Archer AX21 merge_country_config Command Injection Remote Code Execution Vulnerability

CVE ID	CVE-2023-1389
CVSS SCORE	8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AFFECTED VENDORS	TP-Link
AFFECTED PRODUCTS	Archer AX21
VULNERABILITY DETAILS	This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer AX21 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the merge_country_config function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute arbitrary code in the context of root.
ADDITIONAL DETAILS	TP-Link has issued an update to correct this vulnerability. More details can be found at: https://www.tp-link.com/us/support/download/archer-ax21/v3/#Firmware
DISCLOSURE TIMELINE	2023-01-25 - Vulnerability reported to vendor 2023-04-24 - Coordinated public release of advisory
CREDIT	rskvp93, Q5Ca, and hoangnx99 from VcsLab of Viettel Cyber Security and Pham Nguyen Ngoc Bien & Dang Minh Tri from Qrious Secure

BACK TO ADVISORIES