Urgent Security Alert: CISA Flags Two Popular TP-Link Routers with Critical Flaws
Your home or office router is the gateway to your digital world, and a new federal warning highlights why its security can never be taken for granted. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added two vulnerabilities affecting popular TP-Link router models to its Known Exploited Vulnerabilities (KEV) catalog.
This is not a theoretical warning. A vulnerability’s inclusion in the KEV catalog means there is credible evidence that cybercriminals are actively exploiting it in the wild. This elevated threat level requires immediate attention from anyone using the affected devices.
The two models at the center of this alert are:
- TP-Link Archer AX21 (and its European variant, Archer C7 EU)
- TP-Link TL-WR841N
Federal agencies have been given a deadline of June 20, 2024, to patch or decommission these devices, signaling the severity of the risk. While this mandate applies to government networks, it serves as a powerful advisory for businesses and home users to take immediate action.
The Vulnerabilities Explained
Understanding the nature of these flaws reveals why they are so dangerous. Attackers are leveraging them to gain control over networks, steal data, and build botnets for larger attacks.
1. TP-Link Archer Command Injection Flaw (CVE-2023-1389)
This high-severity vulnerability affects the TP-Link Archer AX21 router’s web management interface, with CISA now confirming its presence in the Archer C7 EU version as well. The flaw allows for unauthenticated remote command execution.
In simple terms, an attacker located anywhere in the world can send a specially crafted request to the router and execute commands without needing a username or password. This gives them a powerful foothold in your network. This specific vulnerability has been linked to the notorious Mirai botnet, which enslaves IoT devices like routers to launch massive Distributed Denial-of-Service (DDoS) attacks.
2. TP-Link TL-WR841N Remote Code Execution (CVE-2022-44903)
The vulnerability found in the TL-WR841N model is another critical flaw that permits remote code execution (RCE). This allows a remote attacker to run their own malicious code on the device, effectively granting them complete control. Once compromised, the router can be used to monitor your internet traffic, redirect you to malicious websites, or attack other devices connected to your network.
How to Protect Your Network Immediately
If you own one of the affected TP-Link models, or simply want to improve your network security, follow these essential steps now.
Identify Your Device: Check the sticker on the bottom or back of your router to confirm its exact model number. Pay close attention to whether you have a specific regional version, such as the (EU) variant mentioned in the alert.
Update Your Firmware Immediately: This is the most critical step. The manufacturer, TP-Link, releases firmware updates to patch security holes.
- Log in to your router’s administrative panel (usually by typing
192.168.0.1or192.168.1.1into your web browser). - Look for a section named “System Tools,” “Administration,” or “Firmware Update.”
- Check for and install the latest available firmware for your specific model.
- Log in to your router’s administrative panel (usually by typing
Replace End-of-Life Hardware: Many of these vulnerabilities affect older, budget-friendly routers that may no longer receive security updates from the manufacturer. If a patch is not available for your device, it is no longer safe to use. You should disconnect it from the internet and replace it with a modern router that is actively supported by its manufacturer.
Practice Strong Router Hygiene:
- Change Default Credentials: Never use the default “admin” username and password. Change them to something unique and strong.
- Use a Strong Wi-Fi Password: Secure your wireless network with a WPA3 password if your devices support it, or WPA2 at a minimum.
- Disable Remote Management: Unless you have a specific need for it, disable remote (WAN) access to your router’s administration page. This prevents attackers from trying to log in from outside your local network.
Your router is your first line of defense against online threats. Taking a few minutes to ensure it is updated and secure is one of the most important investments you can make in your digital safety.
Source: https://securityaffairs.com/181886/hacking/u-s-cisa-adds-tp-link-archer-c7eu-and-tl-wr841n-flaws-to-its-known-exploited-vulnerabilities-catalog.html
