ctrlINT What the industry said about every indicator, with the quote

CVE-2023-1389Vulnerability

TP-Link Archer AX-21 Command Injection Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .

Reported by 2 independent sources · first reported by GreyNoise · last reported

Last reported 19 days ago

CISA KEVAdded 1 May 2023
Fix due 22 May 2023
Used by ransomware: not knownCISA KEV catalogue
EPSS100.0%
higher than 99% of CVEsFIRST EPSS, as of 26 Sep 2026

What the reports say

3 reports, newest first · the exact sentence from each

  1. “…TUN” via several IoT command injections targeting multiple devices, including Linear, Realtek (CVE-2021-35394), TP-Link Archer AX21 (CVE-2023-1389), AVTECH AVM1203 (CVE-2024-7029), and D-Link (CVE-2024-10915).”

    Fortinet Threat ResearchVendor
    ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure

  2. “CVE-2023-1389: TP-Link.Archer.AX21.luci.stok.Command.Injection”

    Fortinet Threat ResearchVendor
    Multi-Functional Linux Botnet “Evooo1Bot”

  3. “Both IPs appear extensively in GreyNoise data with histories of CVE exploitation: CVE-2025-55182 (React2Shell), CVE-2023-1389, and over 200 other vulnerabilities.”

    GreyNoiseVendor
    Threat Actors Actively Targeting LLMs

Indicators reported together

named in the same reports
Copy this indicator · defanged

Also named with it: CVE-2022-37055, CVE-2024-10914, CVE-2025-55182, CVE-2016-20016, CVE-2018-14558, CVE-2024-4577, CVE-2025-67038, CVE-2021-36260, CVE-2023-34362, CVE-2024-21887, CVE-2023-46805, CVE-2007-3010, CVE-2016-6277, CVE-2019-14931, CVE-2020-10987, CVE-2021-46422, CVE-2024-29269, CVE-2025-10123, CVE-2025-55583

Thanks — we review every report.

Report a wrong value
What is wrong with CVE-2023-1389 here?
No account needed. We do not store your IP address.