CVE-2023-28760: TP-Link Archer AX21 Router RCE Vulnerability

CVE-2023-28760 Overview

CVE-2023-28760 is a stack-based buffer overflow vulnerability affecting TP-Link AX1800 WiFi 6 Router (Archer AX21) devices. This firmware vulnerability allows unauthenticated attackers on the local area network (LAN) to execute arbitrary code as root via the db_dir field in the minidlnad service. The attacker can modify the files.db database file, which leads to a stack-based buffer overflow in minidlna-1.1.2/upnpsoap.c. Successful exploitation requires that a USB flash drive is connected to the router, a common configuration used by customers to create network shares accessible at \\192.168.0.1.

Critical Impact
Unauthenticated root-level code execution on affected TP-Link routers, allowing complete device compromise and potential lateral movement within the network.

Affected Products

TP-Link AX1800 WiFi 6 Router (Archer AX21)
Devices running vulnerable minidlna-1.1.2 firmware
Routers with USB storage sharing enabled

Discovery Timeline

2025-10-02 - CVE-2023-28760 published to NVD
2025-10-02 - Last updated in NVD database

Technical Details for CVE-2023-28760

Vulnerability Analysis

This vulnerability exploits a weakness in the MiniDLNA media server implementation on TP-Link Archer AX21 routers. The flaw resides in the upnpsoap.c file of minidlna version 1.1.2, where insufficient bounds checking on user-controlled input leads to a stack-based buffer overflow (CWE-121).

The attack surface requires adjacent network access, meaning the attacker must be connected to the same LAN as the target router. While no authentication is required, the attack complexity is elevated due to the prerequisite that USB storage must be attached to the router for the vulnerable code path to be reachable.

Root Cause

The root cause is improper input validation in the MiniDLNA service's handling of the db_dir field. When processing media database operations, the minidlnad daemon fails to properly validate the size of input data before copying it to a fixed-size stack buffer in upnpsoap.c. This allows an attacker to craft malicious input that overwrites adjacent stack memory, including return addresses, enabling arbitrary code execution.

Attack Vector

The attack vector leverages the adjacent network position to target the MiniDLNA service running on the router. The exploitation chain involves:

The attacker connects to the same LAN segment as the vulnerable router
The attacker interacts with the MiniDLNA service to manipulate the db_dir field
This manipulation allows modification of the files.db database file
The crafted database content triggers a stack-based buffer overflow when processed by upnpsoap.c
The overflow allows execution of attacker-controlled code with root privileges

The vulnerability can be exploited without authentication, and successful exploitation grants the attacker complete control over the router with root-level access. Technical details and proof-of-concept information are available in the GitHub Gist PoC Repository and the TecSecurity Blog Post.

Detection Methods for CVE-2023-28760

Indicators of Compromise

Unexpected modifications to the files.db database file on USB storage attached to the router
Anomalous network traffic targeting MiniDLNA service ports (typically UDP 1900 and TCP 8200)
Unusual processes spawned by minidlnad or running as root on the router
Evidence of shell access or command execution originating from the router

Detection Strategies

Monitor network traffic for suspicious UPnP/DLNA requests targeting router services
Implement network segmentation to isolate IoT devices and routers from critical network segments
Deploy network-based intrusion detection systems (NIDS) with signatures for MiniDLNA exploitation attempts
Audit USB storage contents for unexpected file modifications

Monitoring Recommendations

Enable logging on network security appliances to capture traffic to and from router management interfaces
Monitor for lateral movement attempts originating from router IP addresses
Implement alerting for new connections from the router to external IP addresses
Review router logs for service crashes or restarts of the minidlnad service

How to Mitigate CVE-2023-28760

Immediate Actions Required

Disconnect USB storage devices from affected TP-Link Archer AX21 routers until a patch is applied
Disable the media server/DLNA functionality in the router's administrative interface if not required
Implement network segmentation to limit access to the router from untrusted LAN clients
Monitor for firmware updates from TP-Link addressing this vulnerability

Patch Information

As of the last update to this CVE, users should check the official TP-Link support website for firmware updates addressing CVE-2023-28760. Apply the latest available firmware for the Archer AX21 router to remediate this vulnerability. Firmware updates should be downloaded only from official TP-Link sources to avoid supply chain risks.

Workarounds

Remove USB storage devices from the router to eliminate the attack prerequisite
Disable the MiniDLNA/Media Server feature through the router's web administration interface
Implement MAC address filtering to restrict LAN access to trusted devices only
Consider deploying a separate, dedicated NAS device for network storage instead of using router-attached storage

bash

# Access router configuration and disable media server
# Navigate to: Advanced > USB Settings > Media Server
# Set "Media Server" to Disabled
# Apply changes and reboot router