CVE-2023-1389

This bug is like a “back door” in the router’s website. If someone reaches the router, they can trick it into running attacker commands instead of doing the harmless setting update, and those commands run with root-level power. For a business, that can mean the router is no longer trustworthy because attackers may redirect your internet traffic or keep harmful changes in place.

This matters if you use the TP-Link Archer AX21 (AX1800) router and its firmware is earlier than 1.1.4. It is a web-management problem, so the key factor is reachability: it is a risk when the vulnerable web endpoint can be accessed by an attacker (for example, over the internet) and a simple POST request is possible; KEV listing indicates real-world abuse. If your router management interface is not exposed to the internet and isn’t reachable by outsiders, the exposure is lower—but you should still update because the bug is confirmed and has a public exploit.

This is urgent because it is confirmed in the CISA Known Exploited Vulnerabilities catalog and there are public exploits available. Attackers are actively targeting router management interfaces, and the issue enables command execution as root, so successful exploitation can lead to full device control and disruption. Treat this as a “fix now” item for affected Archer AX21 routers with firmware older than 1.1.4.