CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

CVE-2023-33538: TP-Link Multiple Routers Command Injection Vulnerability

criticalknown exploitedpublic exploitCVE-2023-33538
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

CSIRTS triage

vendor: TP-LinkCode injection
What
A command injection vulnerability exists via the component /userRpm/WlanNetworkRpm.
Who is affected
Users of the specified TP-Link router models are affected.
Urgency
Remediation is urgent as exploitation is possible and the severity is critical.
Action
Discontinue use of the affected products or apply any available patches.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source
CISA Known Exploited Vulnerabilities (US · database · site)
Severity
critical
Published
2025-06-16
Exploitation
Observed in the wild (CISA KEV)

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-33538

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Referenced CVEs

CVECSIRTS overviewExternal
CVE-2023-33538coverage & exploitation statusNVD · CVE.org

More from CISA Known Exploited Vulnerabilities