TP-Link - RCE (CVE-2023-33538)
Description
TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .
psychologyCrowdSec Analysis
CVE-2023-33538 is a command injection vulnerability affecting multiple TP-Link router models, including TL-WR940N, TL-WR841N, and TL-WR740N, through the /userRpm/WlanNetworkRpm component. Attackers with limited privileges can exploit this flaw to execute arbitrary commands on the device, potentially leading to full system compromise, data theft, or disruption of network services.
CrowdSec has been tracking this vulnerability and its exploits since 12th of September 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2023-33538 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the router's web interface by sending crafted requests to /userRpm/WlanNetworkRpm.htm, injecting OS commands via the ssid1 parameter to achieve command execution or establish a reverse shell.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2023-06-07 |
| CISA KEV | 2025-06-16 |
| CISA Remediation Deadline | 2025-07-07 |
| Rule Released | 2025-09-12 |
| CrowdSec First Seen | 2026-04-18 |
Remediation & Protection
External References
- https://www.tp-link.com/us/support/faq/3562/
- https://web.archive.org/web/20230609111043/https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/3/TL-WR940N_TL-WR841N_userRpm_WlanNetworkRpm_Command_Injection.md
- https://www.secpod.com/blog/cisa-issues-warning-on-active-exploitation-of-tp-link-vulnerability-cve-2023-33538/
- https://github.com/rix4uni/cvemapping/blob/main/2023/CVE-2023-33538/tplink.py