Actively exploited in the wild
TP-Link Multiple Routers Command Injection Vulnerability
TP-Link — Multiple Routers · Listed in the CISA KEV since 2025-06-16. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2023-33538
HighCVSS 8.8KEVExploitation Probability (EPSS)
Very high risk99th percentile — higher than 99% of all known CVEs
Summary
A command injection vulnerability was discovered in TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 via the component /userRpm/WlanNetworkRpm.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary commands on the device, potentially leading to full control over it.
Recommendation
It is recommended to update the device firmware to the latest version to mitigate this vulnerability.
Original NVD description (English source)
TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .