CVE-2023-33538

HIGHCISA KEV

TP-Link Multiple Routers Command Injection Vulnerability

Title source: CISA
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-33538 has a selected CVSS score of 8.8 (high); EIP currently links 3 repository PoCs. CISA lists CVE-2023-33538 in KEV.

Description

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .

Description source: CVE List

Exploitation context

Known exploitation

CISA KEV
Listed · Jun 16, 2025 · CISA
VulnCheck KEV
Listed · Jun 16, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
3

CISA SSVC decision

ExploitationActive
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 16, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Multiple Routers

Browse TP-Link / Multiple Routers
CISAVersion data not supplied

Proofs of concept

3

Repository PoCs

GitHubexplxx/CVE-2023-33538Repository PoCby explxx1Not analyzed2 files

5.9 KiB

GitHub
PoC details
GitHubmrowkoob/CVE-2023-33538-msfRepository PoCby mrowkoob1Not analyzed2 files

4.7 KiB

GitHub
PoC details
GitHubeev4n/tplink-osciRepository PoCby eev4n0Exploit2 files

1.9 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script (xp.py) that exploits CVE-2023-33538, a command injection vulnerability in TP-Link routers. It sends a crafted HTTP request to /userRpm/WlanNetworkRpm.htm with a malicious ssid1 parameter containing a shell command, or optionally sends a TDDP packet with the command injected into the SSID field.

Backdoor review

No backdoor observed in reviewed code

The repository contains a single Python script (xp.py) that implements a proof-of-concept exploit for CVE-2023-33538, a command injection vulnerability in TP-Link routers. The script sends a crafted payload to the vulnerable endpoint /userRpm/WlanNetworkRpm or via TDDP, executing a user-supplied command. No backdoor, deceptive payload, or concealed operator-directed harm is present. The README.md contains only an image link with no executable content.

ClassificationExploit
Model confidence100%
AuthenticationRequired
Languagespython
Target softwareTP-Link TL-WR940NTP-Link TL-WR841NTP-Link TL-WR740N
Attack typescommand injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a malicious payload designed to execute arbitrary commands on the target device, which constitutes exploitation rather than mere detection or scanning.

xp.py:19-20xp.py:49-50xp.py:52-56

Requirements

  • Target must be a vulnerable TP-Link router model (TL-WR940N V2/V4, TL-WR841N V8/V10, TL-WR740N V1/V2) with the /userRpm/WlanNetworkRpm endpoint accessible.xp.py:1-66
  • Attacker must provide valid HTTP Basic Authentication credentials (default admin:admin).xp.py:12-13xp.py:48xp.py:55

Observed behavior

  • Constructs a command injection payload by replacing spaces with ${IFS} and embedding the command in the ssid1 parameter.xp.py:19-20xp.py:49-50
  • Sends an HTTP GET request to /userRpm/WlanNetworkRpm.htm with the malicious ssid1 parameter and Basic auth cookie.xp.py:52-56
  • Optionally sends a crafted TDDP UDP packet to port 1040 with the command injected into the SSID field.xp.py:25-36
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThis is the expected behavior for a PoC exploit targeting CVE-2023-33538. The command is user-supplied and not hardcoded to perform malicious actions.xp.py:19-20xp.py:29-30xp.py:49-52
User Controlled Command
Payload withheldThe script does not contain any hardcoded malicious command; the operator controls what is executed on the target.xp.py:14xp.py:19-20
Authentication Handling
Payload withheldThis is standard for accessing the router's web interface and does not indicate credential theft or exfiltration.xp.py:48xp.py:55
Review boundaries

What the analysis did not establish

  • The README.md contains an external image link (https://o.uguu.se/zJMxTaaq.jpg) which was not fetched or analyzed; its content is unknown but is not executable code within the repository.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

6