CISA warns of active exploitation of discontinued TP-Link router models
Take action: If you have old TP-Link routers (TL-WR940N, TL-WR841N, TL-WR740N models from 2010-2018), replace them immediately since they're discontinued, are actively exploited and there is even publicly available exploit code. If you can't replace right away, contact TP-Link support for emergency patches or isolate these devices from the internet until you can upgrade to a supported router model.
Learn More
CISA has issued an alert about active exploitation of a high-severity command injection vulnerability affecting multiple discontinued TP-Link wireless router models.
The security flaw is tracked as CVE-2023-33538 (CVSS score 8.8) - Command injection vulnerability. The vulnerability stems from inadequate input sanitization within the /userRpm/WlanNetworkRpm component of the affected routers. The flaw allows remote attackers to execute arbitrary system-level commands by submitting specially crafted HTTP GET requests that manipulate the ssid1 parameter.
It affects several popular TP-Link router models that have long reached their end-of-life status, including the TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2. These models were discontinued between 2010 and 2018, meaning they no longer receive security updates or technical support from TP-Link.
Many of these devices are still widely deployed across both residential and commercial networks. Some models are even still available for purchase through major online retailers where they maintain thousands of positive customer reviews.
Proof-of-concept exploit code targeting this security flaw was previously published on GitHub, though it has since been removed from the platform. The exploit code remains "widely available" through other online sources, significantly lowering the barrier for malicious actors to weaponize this vulnerability.
TP-Link has responded to inquiries about the vulnerability by stating that it provided fixes for this security flaw as early as 2018 through its technical support platform. However, the company acknowledged that the affected router models have been officially discontinued since 2017. TP-Link encourages customers still using these legacy devices to contact technical support for patched firmware that addresses the vulnerability. The company strongly recommends upgrading to supported models that receive automatic security updates for ongoing protection.
