Is CVE-2023-1389 (TP-Link Archer AX-21 Command Injection) being exploited in the wild?

Yes. CISA added CVE-2023-1389 to its Known Exploited Vulnerabilities catalogue on 1 May 2023, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution. Any organisation running the affected product should treat remediation as urgent.

What “exploited in the wild” means for CVE-2023-1389

For this CVE, the practical question is not whether the flaw exists, but whether defenders should treat it as an active threat. CISA’s KEV listing is the key signal: once a vulnerability is added there, organisations should assume real exploitation pressure and prioritise response based on exposure, asset criticality, and whether the affected device sits at the network edge.

A command injection issue in a router or other edge device is especially important because it can turn a routine product flaw into remote code execution. That changes the problem from “patch eventually” to “confirm exposure, constrain access, and verify whether the device has already been used as an entry point or foothold.”

When a vulnerability is actively exploited, the security question becomes operational: is the vulnerable product present, reachable, and managed well enough to be trusted? For consumer and small-office networking gear, that often means the device is both internet-exposed and lightly monitored, which increases the chance that exploitation goes unnoticed until there is follow-on abuse.

Why this vulnerability is operationally urgent

Remote code execution on a router can affect confidentiality, integrity, and availability at the same time. An attacker who gains command execution may alter traffic handling, redirect users, drop monitoring, or establish persistence on a device that defenders rarely inspect as closely as servers or endpoints.

This is why edge-device flaws often deserve faster treatment than ordinary application bugs. The exposed system sits in a privileged traffic position, and compromise can create a trusted launch point for internal reconnaissance, credential capture, or downstream abuse of adjacent systems.

For practitioners, the immediate decision is whether the asset is actually in service and whether it can be safely removed or replaced. If the device is customer-facing or business-critical, urgency comes not just from the exploit itself but from the blast radius of losing trust in the network boundary.

What to do before and after patching

Start by confirming whether the affected model is deployed anywhere in the environment, including branch sites, home offices, lab networks, and unmanaged edge segments. Then determine whether the device is internet-reachable, whether remote administration is enabled, and whether any unusual configuration changes or outbound connections have appeared since the vulnerability became public.

If remediation must wait, reduce exposure first: remove unnecessary external access, restrict administrative reachability, segment the device from sensitive internal assets, and monitor for signs of tampering. If the router or gateway supports logs, preserve them before rebooting or replacing the device, because a reset can erase evidence of exploitation.

After patching or replacement, do not stop at version confirmation. Validate that administrative credentials remain known only to the owner, review for unknown port forwards, DNS changes, or route manipulation, and check whether the device has been used to pivot to other systems. For CISA’s Known Exploited Vulnerabilities Catalog is the authoritative place to confirm current response expectations.

Risk and Threat Considerations

Actively exploited edge-device vulnerabilities are attractive because they often sit outside standard endpoint telemetry and can provide durable, high-trust access. In this case, the combination of command injection and internet-facing deployment means an attacker may be able to move from initial exploitation to persistent control with very little user interaction.

Failure mechanism: The flaw allows remote command execution, so an attacker can run operating-system commands through the device’s management or web interface and use that access to change configuration, intercept traffic, or establish persistence.

Impact: Exposure can extend beyond the router itself, including credential interception, network redirection, internal reconnaissance, and a trusted foothold for later compromise of other systems.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5, NIST CSF 2.0 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-4 — Secure Configuration of Enterprise Assets and Software	A KEV-listed router flaw demands hardened, validated configuration and exposure reduction.
	CIS-7 — Continuous Vulnerability Management	This question is about an actively exploited vulnerability requiring rapid prioritisation and remediation.
Recommendation — Harden the device, remove unnecessary exposure, and verify the configuration after remediation. Prioritise the asset for emergency remediation and track verification to closure.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Active exploitation of a router command injection vulnerability is a direct flaw-remediation case.
	RA-5 — Vulnerability Monitoring and Scanning	Confirming affected-device exposure and post-remediation validation depends on vulnerability monitoring.
	AC-4 — Information Flow Enforcement	Compromised edge devices can redirect or expose traffic, making flow control material.
Recommendation — Accelerate remediation, validate exposure, and confirm the vulnerability is removed. Scan for affected assets and verify remediation with repeat assessment. Restrict traffic paths so a compromised device cannot freely bridge sensitive segments.
NIST CSF 2.0	ID.RA-01 — Asset Vulnerabilities Are Identified and Prioritised	The answer hinges on identifying an exposed KEV vulnerability and prioritising it for response.
	PR.PS-05 — Assets Are Configured and Maintained	The flaw is in a maintained network device whose secure configuration and patch state are central.
Recommendation — Identify affected assets quickly and escalate remediation based on exposure and criticality. Maintain the device in a secure state and remove unsafe exposure before normal operation resumes.
OWASP ASVS	V15 — Secure Coding and Architecture	The vulnerability is a command injection flaw, which maps to secure design and input handling concerns.
Recommendation — Use architectural and input-handling controls that prevent command execution through untrusted input.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	The attack path is public-facing exploitation of an exposed management interface or service.
	T1059 — Command and Scripting Interpreter	Command injection ultimately gives the attacker command execution on the target device.
Recommendation — Map exposed device services to public-facing exploitation detections and hunt for initial access. Detect and investigate command execution behavior that should not occur on the device.

Practitioner Guidance

What to prioritise: Treat the device as urgent if it is exposed to the internet, performs routing for a business segment, or has any history of unmanaged administration. In those cases, replacement or isolation is often safer than trying to preserve service while investigating.

What to verify: Confirm whether the device has been patched or removed, then review logs, configuration backups, DNS settings, port forwards, and administrator accounts for unexpected changes. If you cannot trust the local state, assume the device may have been modified and rebuild it rather than “cleaning” it in place.

Decision rule: If the router also stores credentials, secrets, or remote-management settings, rotate any material that could have been observed or altered before you restore normal connectivity.

Practitioner takeaway: For a KEV-listed edge-device flaw, exposure and trust matter more than the product family itself, because the real risk is not only exploitation, but the network position the compromised device can immediately abuse.