TP-Link Archer AX21 merge_country_config Command Injection Remote Code Execution Vulnerability [CVE-2023-1389]

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer AX21 routers.

Authentication is not required to exploit this vulnerability.

The specific flaw exists within the merge_country_config function.

The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call.

An attacker can leverage this vulnerability to execute arbitrary code in the context of root.

TP-Link has issued an update to correct this vulnerability.

Affected products = Archer AX21

Blogger at www.systemtek.co.uk