CVE-2023-1389 Potential Exploitation Attempt - TP-Link Archer AX21 Command Injection

SigmaHQ Detections@sigmaHQ

•updated May 20, 2025•0•24

Detects potential exploitation attempt of CVE-2023-1389, an Unauthenticated Command Injection vulnerability in TP-Link Archer AX21 routers. The rule looks for specific URI patterns and keywords indicative of an attempt to inject commands via the 'country' parameter.