A Deep Dive Into Attempted Exploitation of CVE-2023
Mirai-like botnet scans exploit TP-Link EOL router flaw CVE-2023-33538 after CISA KEV addition, though observed exploit code is flawed.
Unit 42 observed large-scale automated scans attempting to exploit CVE-2023-33538 in end-of-life TP-Link TL-WR940N, TL-WR740N and TL-WR841N routers after CISA added the flaw to its KEV catalog in June 2025. HTTP GET requests inject commands via the ssid1 parameter at the /userRpm/WlanNetworkRpm endpoint to download and execute an arm7 ELF binary, a Mirai variant related to the Condi IoT botnet. Firmware emulation and reverse engineering showed the observed exploits are flawed and would fail, but the underlying vulnerability is real and successful exploitation requires authentication to the router's web interface. TP-Link confirmed the devices are end-of-life with no patches available and recommends replacing units and eliminating default credentials.
- Targets TL-WR940N, TL-WR740N and TL-WR841N end-of-life routers
- Commands injected via ssid parameter using default admin:admin Basic authentication
- Downloads arm7 ELF binary from 51.38.137.113, a Mirai/Condi variant
- Observed exploit payloads are flawed and would fail on TL-WR940N
- CISA added CVE-2023-33538 to the KEV catalog in June 2025
- CVEs
- CVE-2023-33538
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-33538 | Command Injection in TP-Link TL-WR940N, TL-WR841N, TL-WR740N Routers | 8.8 | 42% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | vietdediserver.shop | . This IP address is also associated with the domain cnc.vietdediserver[.]shop , which is a known, malicious domain associated with Mira |
| ipv4 | 51.38.137.113 | Linkable Format (ELF) binary named arm7 from the IP address 51.38.137[.]113 into the /tmp directory. The next command executes chmod |
| url | http://192.168.0.1/WCYCPJQAHXBRCQSC/userRpm/Index.htm | ted a session token that is reflected in the following URL: hxxp[:]//192.168.0[.]1/WCYCPJQAHXBRCQSC/userRpm/Index.htm As the session token was sufficiently random, it was no |
From the original article
13 min read at unit42.paloaltonetworks.com
We identified active, automated scans and probes attempting to exploit CVE-2023-33538 , a vulnerability in several end-of-life TP-Link Wi-Fi router models: The observed payloads are malicious binaries characteristic of Mirai-like botnet malware, which the exploits attempt to download and execute on vulnerable devices.
By Asher Davila, Malav Vyas, Chris Navarrete · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.