{"id":"CVE-2023-33538","kind":"vulnerability","aliases":["CVE-2023-33538"],"related":[],"title":"TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection…","description":"TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"TP-Link TL-WR940N, TL-WR841N and TL-WR740N home routers have a command injection flaw in the /userRpm/WlanNetworkRpm web component. An attacker who can reach the router's web interface can run operating system commands on the device.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2025-06-16T00:00:00+00:00","products":[{"name":"TP-Link Multiple Routers","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link tl-wr940n firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link tl-wr841n firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"tp-link tl-wr740n firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","routers","self-hosted","tp-link"],"not_affected_if":["no-affected-router-in-use","unaffected-models"],"how_to_check":"Identify any TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10 or TL-WR740N V1/V2 in use, including on branch or remote sites.","fix":"Discontinue use of the affected models, since the sources say they are end-of-life and no fix is given; if replacement is not possible, follow CISA's instruction to apply vendor mitigations.","status":"open","published_at":"2023-06-07T04:15:10+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:46:56+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:46:56Z","model":"claude-haiku-5-5","output":{"fix":"Discontinue use of the affected models, since the sources say they are end-of-life and no fix is given; if replacement is not possible, follow CISA's instruction to apply vendor mitigations.\nunknown","reach":"unknown","summary":"TP-Link TL-WR940N, TL-WR841N and TL-WR740N home routers have a command injection flaw in the /userRpm/WlanNetworkRpm web component. An attacker who can reach the router's web interface can run operating system commands on the device.","category":"infrastructure","who_cares":["tp-link","routers","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands on the router, taking over the network traffic it carries.","analyst_note":"Sources do not say whether the web interface must be LAN-only or can be reached from WAN, nor whether authentication is required; check the CISA KEV entry and vendor advisory for those details.","how_to_check":"Identify any TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10 or TL-WR740N V1/V2 in use, including on branch or remote sites.\nunknown","needs_analyst":true,"not_affected_if":["unaffected-models","no-affected-router-in-use"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000498,"input_tokens":2604,"output_tokens":476,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':166C '-2023':25A,28A '-33538':26A,29A '/userrpm/wlannetworkrpm':87B,132C '22':165C 'action':156C 'and/or':143C 'appli':157C 'applic':163C 'attack':91B 'bod':164C 'cisa':154C 'cloud':169C 'command':22A,82B,104B,126C 'compon':89B,131C 'contain':20A,124C 'could':136C 'cve':24A,27A 'devic':107B 'discontinu':151C,172C 'discov':18A 'end':139C,145C 'end-of-lif':138C 'end-of-servic':144C 'eo':148C 'eol':142C 'exploit':56B 'firmware':41A,48A,55A 'flaw':84B 'follow':162C 'guidanc':167C 'home':78B 'host':61B 'impact':134C 'infrastructur':57B 'inject':23A,83B,127C 'instruct':161C 'interfac':99B 'life':141C 'link':3A,32A,37A,44A,51A,64B,67B,110C 'mitig':158C,178C 'multiple':33A 'oper':102B 'per':159C 'product':135C,152C,176C 'reach':94B 'requir':155C 'router':58B,79B,96B 'routers':34A 'run':101B 'self':60B 'self-host':59B 'servic':147C,170C 'system':103B 'tl':5A,9A,14A,39A,46A,53A,69B,72B,76B,112C,116C,121C 'tl-wr740n':13A,52A,75B,120C 'tl-wr841n':8A,45A,71B,115C 'tl-wr940n':4A,38A,68B,111C 'tp':2A,31A,36A,43A,50A,63B,66B,109C 'tp-link':1A,30A,35A,42A,49A,62B,65B,108C 'unavail':180C 'use':173C 'user':149C 'util':153C 'v1/v2':16A,123C 'v2/v4':7A,114C 'v8/v10':11A,118C 'vendor':160C 'via':129C 'vulner':128C 'web':88B,98B 'wr740n':15A,54A,77B,122C 'wr841n':10A,47A,73B,117C 'wr940n':6A,40A,70B,113C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-06-07T04:15:10+00:00","kev":{"dateAdded":"2025-06-16","dueDate":"2025-07-07","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-33538","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-33538","severity":null,"published_at":"2025-06-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:40+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-33538","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33538","severity":null,"published_at":"2023-06-07T04:15:10+00:00","modified_at":"2026-06-17T06:01:53+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}