CVE-2023-33538
HIGH KEVTP-Link TL-WR940N TL-WR841N TL-WR740N - OS Command Injection via WlanNetworkRpm Endpoint
Title source: llmExploitation Summary
CVE-2023-33538 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added June 16, 2025. EIP tracks 3 public exploits from researchers including explxx, eev4n, mrowkoob.
AI-analyzed exploit summary This is a functional Python exploit for CVE-2023-33538, targeting TP-Link TL-WR940N/TL-WR841N routers via command injection in the `ssid1` parameter. It supports vulnerability testing, arbitrary command execution, and reverse shell establishment.
Description
TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .
Exploits (3)
This is a functional Python exploit for CVE-2023-33538, targeting TP-Link TL-WR940N/TL-WR841N routers via command injection in the `ssid1` parameter. It supports vulnerability testing, arbitrary command execution, and reverse shell establishment.
This repository contains a functional exploit for CVE-2023-33538, targeting TP-Link routers via command injection in the SSID parameter. The exploit supports both authenticated HTTP requests and unauthenticated TDDP (TP-Link Device Debug Protocol) packets for RCE.
This is a Metasploit auxiliary module that exploits an authenticated command injection vulnerability in TP-Link TL-WR940N/841N routers via the `ssid1` parameter in `WlanNetworkRpm.htm`. It requires a valid Authorization cookie and session path prefix obtained manually.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H