TP-Link routers targeted by Mirai botnet once again, US government warns

Concept art representing cybersecurity principles

Nytt DDoS-rekord (Image credit: Shutterstock / ZinetroN)

The United States Cybersecurity and Infrastructure Security Agency (CISA) is warning businesses to patch TP-Link routers which are being actively targeted by malicious actors looking to recruit them into the Mirai botnet.

“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.” the security advisory reads.

The flaw in certain TP-Link Wi-Fi routers was first spotted by the Zero Day Initiative (ZDI), a program created to encourage the reporting of zero-day vulnerabilities privately to the affected vendors. The program found that since mid-April 2023, threat actors started abusing CVE-2023-1389, a high-severity flaw found in TP-Link Archer A21 (AX1800) Wi-Fi routers. The flaw, carrying a severity score of 8.8, is described as an unauthenticated command injection flaw in the locale API of the web management interface on the device.

Mirai botnet

Hackers are using the flaw to deploy the Mirai malware, ZDI further stated, which turns the targeted device into a bot for the Mirai botnet. They first targeted routers in Eastern Europe earlier this month, only to expand globally later on.

TP-Link was tipped off on the existence of the zero-day in January this year, after two separate research groups demonstrated how to abuse the flaw during the Pwn2Own Toronto hacking event in December 2022. The company first tried to fix the issue in late February, but the patch was incomplete and the devices remained vulnerable.

> A new Mirai variant is attacking Linux devices to build a beastly DDoS botnet

> Mirai botnet now targeting critical flaw in thousands of routers

> These are the best Wi-Fi routers around

In April, however, TP-Link issued a new firmware update that successfully addressed CVE-2023-1389. IT admins and owners of the Archer AX21 AX1800 Wi-Fi router should make sure their device’s hardware is updated at least to version 1.1.4 Build 20230219.

Some of the symptoms of a compromised router include frequent disconnections from the internet, changes on the device’s network settings that no one seems to have made, the resetting of administrator credentials, and the inexplicable overheating of the router.

Check out the best endpoint protection software around

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.