Archer AX21 (Product): news timeline & CVEs

TP-Link Sued by Four More U.S. States Over Router Security and China Ties

Four more U.S. states sued TP-Link over router security claims and alleged China ties.

Florida, Iowa, Montana, and Nebraska sued TP-Link Systems on October 6, joining Texas for five state consumer-protection cases. The complaints allege misleading HomeShield security claims, an overstated split from Chinese affiliate TP-Link Technologies, and privacy policies that omit risk under China's 2017 intelligence law. They cite earlier intrusions, including a China-linked router botnet Microsoft said was mostly TP-Link and Russian military intelligence use of CVE-2023-50224. TP-Link denies the allegations, says U.S. routers are made in Vietnam, and says it does not share customer network data with foreign governments.

The Hacker NewsOct 9, 13:22 UTC · 1d agoPolicy & legal in the wild 3 sources CVE-2023-502241· 1 read

New Linux malware turns vulnerable IoT devices into proxy nodes

Fortinet says ClingSTUN Linux malware exploits known IoT flaws to turn devices into STUN-backed proxy nodes.

Fortinet's FortiGuard Labs is tracking ClingSTUN, a Linux backdoor that compromises internet-facing routers, cameras, DVRs, and other IoT devices and turns them into remotely controlled proxy nodes. Attackers have exploited known command-injection, code-injection, and buffer-overflow flaws in products from Hytec, EnGenius, D-Link, TP-Link, and AVTECH, and the malware contains exploits for seven vulnerabilities. After installation it persists through init and rc scripts, hides its process, disables the watchdog, runs commands, and spreads to other devices across ARM, MIPS, PowerPC, x86, and x86-64. It blends command-and-control into legitimate public STUN traffic used by VoIP and WebRTC.

CSO OnlineOct 6, 11:49 UTC · 4d agoMalware in the wild 6 sources2· 1 read

ClingSTUN Malware Turns Vulnerable IoT Devices Into Persistent Remote Proxy Nodes

ClingSTUN exploits unpatched IoT devices and turns them into persistent proxy nodes using public STUN.

FortiGuard documented ClingSTUN, a Linux backdoor that exploits unpatched internet-facing devices and turns them into persistent proxy nodes, using public STUN so traffic resembles VoIP or WebRTC. Activity expanded from Hytec Inter routers via CVE-2022-36553 to EnGenius CVE-2025-34035, D-Link UPnP CVE-2024-23625, and TP-Link Archer AX21 CVE-2023-1389, plus Realtek, AVTECH, Linear, Ivanti, and Tenda devices. Multi-architecture payloads persist through init scripts, hide as .cling, conceal process data, kill competing processes, and can propagate with seven embedded exploits. CISA added CVE-2023-1389 to the Known Exploited Vulnerabilities catalog in 2023.

GBHackersupdated Oct 6, 11:49 UTC · 4d agofirst Oct 6, 05:03 UTC · 4d agoMalware in the wild 6 sources CVE-2022-36553 CVE-2023-1389

Archer AX21

Timeline3 articles

Related CVEsby mentions

Appears with

TP-Link Sued by Four More U.S. States Over Router Security and China Ties

New Linux malware turns vulnerable IoT devices into proxy nodes

ClingSTUN Malware Turns Vulnerable IoT Devices Into Persistent Remote Proxy Nodes