Historical catalog analysis: CISA added this entry on June 16, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2023-33538 is a command injection vulnerability (CWE-77) identified in several TP-Link router models. The flaw exists within the /userRpm/WlanNetworkRpm component, which could allow an attacker to execute arbitrary commands on the affected device.
Exposure and applicability
This vulnerability applies to the following hardware versions:
* TL-WR940N: V2 and V4
* TL-WR841N: V8 and V10
* TL-WR740N: V1 and V2
Infrastructure owners should note that some of these impacted products may be classified as end-of-life (EoL) or end-of-service (EoS), meaning official vendor support and security updates may no longer be available for certain versions.
Remediation priorities
Based on the reported vulnerability, our analysis suggests the following priority actions for vulnerability management teams:
- Asset Identification: Inventory all networking hardware to identify if any of the specific models and versions listed above are currently deployed in the environment.
- Mitigation Application: For supported devices, apply vendor-provided mitigations immediately.
- Hardware Decommissioning: Because some affected versions may be EoL/EoS, the most effective way to reduce exposure for unsupported hardware is to discontinue use of the product and replace it with a supported alternative.
How to validate remediation
To verify that exposure has been reduced, defenders should move beyond simple version checks. Validation should include:
* Configuration Audit: Confirming that the /userRpm/WlanNetworkRpm component is either patched or no longer accessible via the network.
* Inventory Reconciliation: Verifying through physical or MAC-address audits that EoL/EoS hardware has been physically removed from the production environment and replaced.
Limits and open questions
A primary limitation in remediating this vulnerability is the EoL/EoS status of some affected devices; if a vendor has ceased support for a specific version, no official patch will be released. It remains unknown whether this vulnerability is being actively leveraged by ransomware campaigns. Furthermore, while applying a mitigation reduces risk, residual risk remains if the device continues to be exposed to untrusted networks without further compensating controls.
Source and editorial note
CVE-2023-33538: TP-Link Multiple Routers Command Injection Vulnerability · Source date: June 16, 2025 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: June 19, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 11, 2026 at 00:26 UTC.
Request a Vulnerability Assessment
Turn security intelligence into action.
Discuss your exposure, priorities, and the evidence needed to validate the outcome.
Request a security assessment ↗