Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV A L N N U H H H 8.8 1.0000 100.0 YES
AFFECTED Product Versions Fixed TP-Link Archer AX21 (AX1800) All versions prior to version 1.14 Build 20230219 – —
TIMELINE Mar 14 Reserved by tenable Mar 15 Published (CNA: tenable) May 1 Added to CISA KEV, remediation due 2023-05-22
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.
| Date | Event | Detail |
|---|---|---|
| March 14, 2023 | Reserved | Reserved by tenable |
| March 15, 2023 | Published | Published (CNA: tenable) |
| May 1, 2023 | KEV ADDED | Added to CISA KEV, remediation due 2023-05-22 |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| n/a | TP-Link Archer AX21 (AX1800) | — | All versions prior to version 1.14 Build 20230219 | — |
Authoritative record: CVE-2023-1389 at cve.org
Weaknesses: CWE-77
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-1389 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
