CVE-2023-33538

CVE-2023-33538 is a command injection flaw (CWE-77) in the /userRpm/WlanNetworkRpm component of the web management interface on several legacy TP-Link routers. An attacker who can reach the router's management interface and send crafted requests to that component can cause the device to execute arbitrary operating-system commands. Successful exploitation typically gives the attacker full control of the router, enabling traffic manipulation, DNS hijacking, or pivoting into the connected network. Only the named hardware revisions are affected — TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 — and these products may be end-of-life or end-of-service, meaning fixes may be limited or unavailable. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2025-06-16, indicating exploitation in the wild, and its high EPSS score (41.9%, 99th percentile) points to substantial near-term exploitation risk.

What to do: Inventory for these models and check the hardware version on the device label (TL-WR940N V2/V4, TL-WR841N V8/V10, TL-WR740N V1/V2), then apply TP-Link's mitigations or firmware updates per vendor instructions for that hardware version if still available. Because the products may be end-of-life or end-of-service, prioritize disabling remote/WAN access to the router's management interface, restrict it to trusted networks, and plan replacement of any unit still in service where mitigations are unavailable. CISA's required action is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance (for federal agencies), or discontinue use of the product.