Detects Unauthenticated Command Injection Attempts Against TP-Link Archer AX21 via Proxy Requests
Alerts on proxy HTTP GET/POST requests targeting Archer AX21 CGI locale/country write parameters consistent with command injection attempts.
- Category
- proxy
- Author
- Nasreddine Bencherchali (Nextron Systems), Rohit Jain (SigmaHQ), DRL 1.1
- Published
- 2024-06-25
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies HTTP requests that match a likely unauthenticated command injection pattern targeting the TP-Link Archer AX21 web interface. It looks for GET/POST traffic containing a Luci locale endpoint and a country form write operation with a command substitution marker. The detection relies on proxy HTTP telemetry with request method, URI content, and specific query/body keywords indicative of exploitation attempts.
Reporting behind it
- tenable.comhttps://www.tenable.com/security/research/tra-2023-11
- github.comhttps://github.com/Voyag3r-Security/CVE-2023-1389/blob/4ecada7335b17bf543c0e33b2c9fb6b6215c09ae/archer-rev-shell.py
- zerodayinitiative.comhttps://www.zerodayinitiative.com/blog/2023/4/21/tp-link-wan-side-vulnerability-cve-2023-1389-added-to-the-mirai-botnet-arsenal
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-1389/proxy_exploit_cve_2023_1389_unauth_command_injection_tplink_archer_ax21.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Detects Unauthenticated Command Injection Attempts Against TP-Link Archer AX21 via Proxy Requests
id: 5fd23f28-c88a-495a-9fbd-74d2ba27fc5f
status: test
description: This rule identifies HTTP requests that match a likely unauthenticated command injection pattern targeting the TP-Link Archer AX21 web interface. It looks for GET/POST traffic containing a Luci locale endpoint and a country form write operation with a command substitution marker. The detection relies on proxy HTTP telemetry with request method, URI content, and specific query/body keywords indicative of exploitation attempts.
references:
- https://www.tenable.com/security/research/tra-2023-11
- https://github.com/Voyag3r-Security/CVE-2023-1389/blob/4ecada7335b17bf543c0e33b2c9fb6b6215c09ae/archer-rev-shell.py
- https://www.zerodayinitiative.com/blog/2023/4/21/tp-link-wan-side-vulnerability-cve-2023-1389-added-to-the-mirai-botnet-arsenal
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-1389/proxy_exploit_cve_2023_1389_unauth_command_injection_tplink_archer_ax21.yml
author: Nasreddine Bencherchali (Nextron Systems), Rohit Jain, Huntrule Team
date: 2024-06-25
tags:
- attack.initial-access
- attack.t1190
- cve.2023-1389
- detection.emerging-threats
logsource:
category: proxy
detection:
selection_uri:
cs-method:
- GET
- POST
cs-uri|contains|all:
- /cgi-bin/luci/;stok=/locale
- form=country
selection_keyword:
- operation=write
- country=$(
condition: all of selection_*
falsepositives:
- Vulnerability Scanners
level: medium
license: DRL-1.1
related:
- id: 6c7defa9-69f8-4c34-b815-41fce3931754
type: derived