Mirai botnet actively exploiting high-severity vulnerability found in TP-Link Archer routers

01.05.23

Threat Intelligence Alerts

Researchers at Zero Day Initiative have published an article detailing their detection of the Mirai botnet exploiting a high-severity vulnerability found in TP-Link Archer AX21 Wi-Fi routers. The vulnerability tracked as CVE-2023-1389, initially disclosed in January 2022, has a CVSS score of 8.8, allowing an attacker to execute code without needing authentication. The bug is a command line injection vulnerability and can be exploited by attackers on both the LAN and WAN interfaces of the router.

Starting on the 11th of April, the researchers began detecting public exploitations of this vulnerability, first on devices within Eastern Europe, before eventually spreading to devices worldwide. Once infected, the router would become part of the Mirai botnet and be used in Denial-of-Service (DDoS) and other cyber attacks.

The researchers noted that Mirai could imitate legitimate network traffic, making the compromised device challenging to spot for DDoS detection platforms and firewalls.

It is highly recommended that anyone using TP-Link Archer routers apply the latest patches on their devices to prevent threat actors from exploiting the above vulnerability.

https://www.zerodayinitiative.com/blog/2023/4/21/tp-link-wan-side-vulnerability-cve-2023-1389-added-to-the-mirai-botnet-arsenal – Published April 25th

https://www.bleepingcomputer.com/news/security/tp-link-archer-wifi-router-flaw-exploited-by-mirai-malware/ – Published April 25^th