Emerging Threatmediumtest

CVE-2023-1389 Potential Exploitation Attempt - Unauthenticated Command Injection In TP-Link Archer AX21

Detects potential exploitation attempt of CVE-2023-1389 an Unauthenticated Command Injection in TP-Link Archer AX21.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems), Rohit JainCreated Tue Jun 256c7defa9-69f8-4c34-b815-41fce39317542023

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Proxy Log

CategoryProxy Log← raw: proxy

Detection Logic

detection:
    selection_uri:
        cs-method:
            - 'GET'
            - 'POST'
        cs-uri|contains|all:
            - '/cgi-bin/luci/;stok=/locale'
            - 'form=country'
    selection_keyword:
        - 'operation=write'
        - 'country=$('
    condition: all of selection_*