CVE-2023-33538

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 41.61%
EPSS Percentile: 98.69%
CISA KEV: YES — Known Exploited Vulnerability

Description

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 07-Jun-2023 11:15
Last Modified: 17-Jun-2026 13:01
EPSS Date: 2026-11-05
CWE: CWE-77

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2025-06-16
Remediation Due: 2025-07-07
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://www.tp-link.com/nordic/support/faq/3562/ ; https://nvd.nist.gov/vuln/detail/CVE-2023-33538

CNA Products / Version Status

n/a · n/a Source: CNA · [email protected]
Default status: unknown

n/a — affected

Affected Products / Versions

tp-link / tl-wr940n_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:tp-link:tl-wr940n_firmware:-:*:*:*:*:*:*:*
tp-link / tl-wr841n_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:tp-link:tl-wr841n_firmware:-:*:*:*:*:*:*:*
tp-link / tl-wr740n_firmware Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:o:tp-link:tl-wr740n_firmware:-:*:*:*:*:*:*:*

References

Last enrichment sync: 06-Nov-2026 00:43
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

use brute-force Telnet and other exploits for lateral movement and persistence, and scans targeting CVE-2023-33538 have been observed against unsupported TP-Link models. Nexcorium Botnet Exploits TBK DVR Flaw as Attackers Probe EoL TP-Link Routers
Two coordinated, automated scans attempted to exploit CVE-2023-33538 in end-of-life TPâLink routers to download Mirai-like binaries and establish botnet C2 communication. TP-Link CVE-2023-33538 Exploitation Attempts Fail, but Firmware Analysis Confirms Vulnerability

CVE (2)

Malware (4)

People (4)

MITRE ATT&CK (14)

Vendors (3)

Products (6)

Tools (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.