CVE-2023-28760: TP-Link Archer AX21 Router RCE Vulnerability

CVE-2023-28760 Overview

CVE-2023-28760 is a stack-based buffer overflow vulnerability affecting TP-Link AX1800 WiFi 6 Router (Archer AX21) devices. This firmware vulnerability allows unauthenticated attackers on the local area network (LAN) to execute arbitrary code as root via the db_dir field in the minidlnad service. The attacker can modify the files.db database file, which leads to a stack-based buffer overflow in minidlna-1.1.2/upnpsoap.c. Successful exploitation requires that a USB flash drive is connected to the router, a common configuration used by customers to create network shares accessible at \\192.168.0.1.

Critical Impact

Unauthenticated root-level code execution on affected TP-Link routers, allowing complete device compromise and potential lateral movement within the network.

Affected Products

• TP-Link AX1800 WiFi 6 Router (Archer AX21)
• Devices running vulnerable minidlna-1.1.2 firmware
• Routers with USB storage sharing enabled

Discovery Timeline

• 2025-10-02 - CVE-2023-28760 published to NVD
• 2025-10-02 - Last updated in NVD database

Technical Details for CVE-2023-28760

Vulnerability Analysis

This vulnerability exploits a weakness in the MiniDLNA media server implementation on TP-Link Archer AX21 routers. The flaw resides in the upnpsoap.c file of minidlna version 1.1.2, where insufficient bounds checking on user-controlled input leads to a stack-based buffer overflow (CWE-121).

The attack surface requires adjacent network access, meaning the attacker must be connected to the same LAN as the target router. While no authentication is required, the attack complexity is elevated due to the prerequisite that USB storage must be attached to the router for the vulnerable code path to be reachable.

Root Cause

The root cause is improper input validation in the MiniDLNA service's handling of the db_dir field. When processing media database operations, the minidlnad daemon fails to properly validate the size of input data before copying it to a fixed-size stack buffer in upnpsoap.c. This allows an attacker to craft malicious input that overwrites adjacent stack memory, including return addresses, enabling arbitrary code execution.

Attack Vector

The attack vector leverages the adjacent network position to target the MiniDLNA service running on the router. The exploitation chain involves:

1. The attacker connects to the same LAN segment as the vulnerable router
2. The attacker interacts with the MiniDLNA service to manipulate the db_dir field
3. This manipulation allows modification of the files.db database file
4. The crafted database content triggers a stack-based buffer overflow when processed by upnpsoap.c
5. The overflow allows execution of attacker-controlled code with root privileges

The vulnerability can be exploited without authentication, and successful exploitation grants the attacker complete control over the router with root-level access. Technical details and proof-of-concept information are available in the GitHub Gist PoC Repository and the TecSecurity Blog Post.

Detection Methods for CVE-2023-28760

Indicators of Compromise

• Unexpected modifications to the files.db database file on USB storage attached to the router
• Anomalous network traffic targeting MiniDLNA service ports (typically UDP 1900 and TCP 8200)
• Unusual processes spawned by minidlnad or running as root on the router
• Evidence of shell access or command execution originating from the router

Detection Strategies

• Monitor network traffic for suspicious UPnP/DLNA requests targeting router services
• Implement network segmentation to isolate IoT devices and routers from critical network segments
• Deploy network-based intrusion detection systems (NIDS) with signatures for MiniDLNA exploitation attempts
• Audit USB storage contents for unexpected file modifications

Monitoring Recommendations

• Enable logging on network security appliances to capture traffic to and from router management interfaces
• Monitor for lateral movement attempts originating from router IP addresses
• Implement alerting for new connections from the router to external IP addresses
• Review router logs for service crashes or restarts of the minidlnad service

How to Mitigate CVE-2023-28760

Immediate Actions Required

• Disconnect USB storage devices from affected TP-Link Archer AX21 routers until a patch is applied
• Disable the media server/DLNA functionality in the router's administrative interface if not required
• Implement network segmentation to limit access to the router from untrusted LAN clients
• Monitor for firmware updates from TP-Link addressing this vulnerability

Patch Information

As of the last update to this CVE, users should check the official TP-Link support website for firmware updates addressing CVE-2023-28760. Apply the latest available firmware for the Archer AX21 router to remediate this vulnerability. Firmware updates should be downloaded only from official TP-Link sources to avoid supply chain risks.

Workarounds

• Remove USB storage devices from the router to eliminate the attack prerequisite
• Disable the MiniDLNA/Media Server feature through the router's web administration interface
• Implement MAC address filtering to restrict LAN access to trusted devices only
• Consider deploying a separate, dedicated NAS device for network storage instead of using router-attached storage

# Access router configuration and disable media server
# Navigate to: Advanced > USB Settings > Media Server
# Set "Media Server" to Disabled
# Apply changes and reboot router