Botnets continue exploiting year-old flaw in unpatched TP
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-1389 | Command Injection in TP-Link Archer AX21 Router Allows Remote Code Execution CVE-2023-1389 is a command injection flaw (CWE-77) in TP-Link's Archer AX21 Wi-Fi 6 router that lets an attacker execute arbitrary operating-system commands on the device. It is triggered by sending crafted input to a remotely reachable service on the router, which passes attacker-controlled values to the device's shell without proper sanitization; the source data does not specify the vulnerable endpoint or exact affected firmware ranges. Successful exploitation yields remote code execution on the router, giving the attacker a foothold in the network where the router sits, from which they can pivot or abuse the device further. Any household or organization running an Archer AX21 router is affected, with the highest risk where the router's management interface is exposed to the internet. The flaw was added to CISA's KEV catalog on 2023-05-01, confirming exploitation in the wild; EPSS assigns a ~100% probability of exploitation within 30 days (top percentile), while no public proof-of-concept or ransomware association is documented in the source data. Do: Update the Archer AX21 to the latest firmware available from TP-Link per the vendor's instructions (fixed firmware is published on the product's TP-Link support page). If updating is not immediately possible, disable WAN-side/remote management and restrict the router's web interface to the local network. Because exploitation is confirmed in the wild, also review exposed routers for signs of compromise, such as unexplained configuration changes or unexpected outbound traffic. | 8.8 | 100% | KEV PoC ×2 |
| masslikely hundreds of thousands of routers deployed, with >100k plausibly internet-exposed |
Full article242 words · extracted from therecord.media · click to collapse
Attackers continue to exploit a vulnerability in unpatched TP-Link internet routers, adding them to various botnets that can be used to disrupt websites with bogus traffic. The flaw — CVE-2023-1389 — was discovered last December and patched in March. It affects the Archer AX21, a popular model manufactured by the Hong Kong-based company, which has long been a target of botnet operators. Researchers at cybersecurity firm Fortinet said on Tuesday that they observed multiple attacks focusing on this year-old vulnerability, including botnet malware such as Moobot, Mirai, Condi and Gafgyt. The malicious code allows attackers to take control of devices for distributed denial-of-service (DDoS) attacks. Last April, researchers at Trend Micro reported that hackers exploited the same vulnerability to attack TP-Link routers primarily based in Eastern Europe, adding them to the Mirai botnet. Firmware updates are available from TP-Link. CVE-2023-1389 is a command injection vulnerability, meaning that an attacker can execute arbitrary instructions on a target system or application. It carries the CVSS severity score of 8.8 out of 10. “As usual, botnets relentlessly target Internet of Things (IoT) vulnerabilities, continuously attempting to exploit them,” Fortinet said. “Despite the discovery and provided remediation for the vulnerability CVE-2023-1389 last year, numerous campaigns still exploit it, resulting in significant peaks in our IPS telemetry.” Researchers ask users to be vigilant against DDoS botnets and promptly apply patches to safeguard their network environments from infection and prevent them from becoming bots for malicious threat actors.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/tp-link-router-vulnerability-botnets