CVE-2023-33538
TP-Link Multiple Routers Command Injection Vulnerability
Description
CVE-2023-33538 is a high-severity command injection vulnerability affecting multiple TP-Link router models, including the TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2. The vulnerability resides in the /userRpm/WlanNetworkRpm component of the router's web management interface, allowing an authenticated attacker to inject and execute arbitrary operating system commands on the device. With a CVSS v3.1 base score of 8.8 (HIGH severity), the flaw is remotely exploitable with low privileges and no user interaction required. CISA has confirmed active exploitation by adding CVE-2023-33538 to the Known Exploited Vulnerabilities catalog, and its extraordinary EPSS score of 91.32% at the 100th percentile places it among the most actively exploited vulnerabilities in consumer networking equipment.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| tp-link | tl-wr940n firmware | - |
| tp-link | tl-wr841n firmware | - |
| tp-link | tl-wr740n firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/3/TL-WR940N_TL-WR841N_userRpm_WlanNetworkRpm_Command_Injection.md(Broken Link, Exploit, Third Party Advisory)
- https://web.archive.org/web/20230609111043/https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/3/TL-WR940N_TL-WR841N_userRpm_WlanNetworkRpm_Command_Injection.md(Exploit, Third Party Advisory)
- https://www.secpod.com/blog/cisa-issues-warning-on-active-exploitation-of-tp-link-vulnerability-cve-2023-33538/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33538(US Government Resource)
- https://www.tp-link.com/us/support/faq/3562/(Product)
Weakness Type
CWE-77: Improper Neutralization of Special Elements used in a Command (Command Injection)
The command injection weakness in CVE-2023-33538 occurs when the TP-Link router's web interface constructs operating system commands using user-supplied input without properly neutralizing special characters. The /userRpm/WlanNetworkRpm component incorporates parameters directly into system commands, allowing an attacker to inject additional commands through shell metacharacters such as semicolons, pipes, or backticks.
Learn more: CWE-77 — Improper Neutralization of Special Elements used in a Command (Command Injection)
Impact Analysis
The impact of CVE-2023-33538 extends across all three CIA dimensions with Confidentiality (High), Integrity (High), and Availability (High) ratings. The vulnerability is network-accessible (AV:N) with low attack complexity (AC:L), requires only low privileges (PR:L), and needs no user interaction (UI:N). Successful command injection on a TP-Link router grants the attacker full control over the device, enabling interception of all network traffic, DNS manipulation for phishing attacks, lateral movement into the internal network, and use of the compromised router as a persistent foothold in a botnet. The EPSS score of 91.3% at the 100th percentile confirms this is among the most heavily exploited vulnerabilities in consumer networking equipment. The fact that multiple router models are affected (TL-WR940N, TL-WR841N, TL-WR740N) across several hardware versions dramatically increases the attack surface available to threat actors.
Exploit Maturity
CVE-2023-33538 has extremely high exploit maturity, evidenced by its exceptional EPSS score of 91.32% at the 100th percentile, placing it in the top 0.4% of all vulnerabilities for exploitation probability. CISA has confirmed active exploitation in the wild. Public exploit code is available via GitHub (with an archived copy available), providing detailed exploitation steps. Consumer routers like the TP-Link TL-WR940N, TL-WR841N, and TL-WR740N are prime targets for botnet operators and are frequently recruited into large-scale IoT botnets used for DDoS attacks and cryptomining.
Remediation
-
Update router firmware immediately to the latest available version. Check the TP-Link support page for patched firmware for the TL-WR940N, TL-WR841N, and TL-WR740N models. If no patch is available for your specific hardware version, consider replacing the router.
-
Disable remote management on all affected TP-Link routers to prevent exploitation from the internet. Ensure the web management interface is accessible only from the local network, and change the default management port if possible.
-
Change all administrative credentials on the router and ensure strong, unique passwords are used. The command injection requires authenticated access, so strong credentials provide a meaningful defense layer.
-
Segment network access to the router's management interface by configuring access control lists that limit which internal IP addresses can reach the /userRpm/WlanNetworkRpm endpoint and other management functions.
-
Monitor for indicators of compromise including unexpected DNS server changes, new port forwarding rules, modified wireless settings, or unusual outbound traffic from the router's management IP. Consider deploying a network monitoring solution upstream of affected routers to detect suspicious traffic patterns.
Technical Details
CVE-2023-33538 is a command injection vulnerability in the web management interface of multiple TP-Link router models, specifically in the /userRpm/WlanNetworkRpm component. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a network-accessible (AV:N), low-complexity (AC:L) attack requiring low privileges (PR:L) and no user interaction (UI:N), with high impact across confidentiality, integrity, and availability. The WlanNetworkRpm component processes wireless network configuration parameters submitted through the router's HTTP-based administration interface. User-supplied values are incorporated directly into shell commands executed on the router's embedded Linux operating system without proper sanitization or escaping of shell metacharacters. An authenticated attacker can inject arbitrary commands by including shell metacharacters such as semicolons (;), pipes (|), or command substitution sequences ($()) in the wireless configuration parameters. The injected commands execute with root privileges on the router, as the web server process typically runs as root on these embedded devices. The TL-WR940N (V2/V4), TL-WR841N (V8/V10), and TL-WR740N (V1/V2) all share the vulnerable WlanNetworkRpm handler code.
Frequently Asked Questions
Is CVE-2023-33538 being actively exploited?
Yes, CISA has confirmed active exploitation in the wild by adding CVE-2023-33538 to the Known Exploited Vulnerabilities catalog. The extraordinary EPSS score of 91.32% at the 100th percentile places it among the top 0.4% of all vulnerabilities in terms of exploitation probability. Public exploit code is readily available.
What products are affected by CVE-2023-33538?
Multiple TP-Link router models are affected: TL-WR940N (V2/V4), TL-WR841N (V8/V10), and TL-WR740N (V1/V2). All of these are popular consumer and small-office routers with a large installed base worldwide.
How do I fix CVE-2023-33538?
Update the router firmware to the latest version available from TP-Link's support page. If no patched firmware is available for your hardware version, replace the router with a supported model. Disable remote management and use strong administrative credentials as interim mitigations.
How severe is CVE-2023-33538?
CVE-2023-33538 is rated HIGH with a CVSS v3.1 score of 8.8. The command injection vulnerability allows an authenticated attacker to execute arbitrary commands with root privileges on the router, enabling complete device compromise, network traffic interception, and potential botnet recruitment.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.