Various Botnets Pummel Year-Old TP-Link Flaw in IoT Attacks

A year-old unauthenticated command-injection flaw (CVE-2023-1389) in TP-Link Archer AX21 routers is being actively exploited by multiple botnets (Mirai variants, Moobot, Miori, Agoent, a Gafgyt variant, Condi) to compromise devices for IoT-driven DDoS and persistent control; FortiGuard researchers observed traffic spikes, detail the exploitation mechanics, enumerate IoCs (C2 servers, URLs, files), and recommend applying patches to mitigate infections.