TP-Link Multiple Routers Command Injection Vulnerability

HIGH 8.8EXPLOITED (CISA KEV)CVE-2023-33538 · Published 07/06/2023 · updated 17/06/2026

TP-Link Multiple Routers Command Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 16/06/2025. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
Multiple Routers TP-Link	Versions not published yet (product named by CISA KEV)

Description

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .

References

a101e-IoTvul/iotvul · Broken Link
web.archive.org/web/20230609111043/https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/3/TL-WR940N_TL-WR841N_userRpm_WlanNetworkRpm_Command_Injection.md · Exploit
secpod.com/blog/cisa-issues-warning-on-active-exploitation-of-tp-link-vulnerability-cve-2023-33538 · Third Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
tp-link.com/us/support/faq/3562 · Product
CISA KEV · CVE-2023-33538

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free