CVE-2023-33538

HIGH KEV

TP-Link - Command Injection

Title source: llm

Description

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .

Exploits (2)

nomisec WORKING POC 1 stars
by explxx · remote-auth
https://github.com/explxx/CVE-2023-33538
nomisec WORKING POC
by mrowkoob · remote-auth
https://github.com/mrowkoob/CVE-2023-33538-msf

Scores

CVSS v3 8.8
EPSS 0.8990
EPSS Percentile 99.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CISA KEV 2025-06-16
VulnCheck KEV 2025-06-16
ENISA EUVD EUVD-2023-37697
CWE
CWE-77
Status published
Products (3)
tp-link/tl-wr740n_firmware
tp-link/tl-wr841n_firmware
tp-link/tl-wr940n_firmware
Published Jun 07, 2023
KEV Added Jun 16, 2025
Tracked Since Feb 18, 2026