TP-Link router flaws exploited by botnet
Take action: If you're using TP-Link routers, isolate the admin interface from public internet access. Especially if you are running Archer C7, TL-WR841N, or TL-WA855RE. Then update to the latest firmware. Finally, plan to replace any end-of-life models that can't be patched. Such devices will be hacked, given enough time.
Learn More
CISA has added three TP-Link router vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation by threat actors associated with the Quad 7 botnet.
Independent security researchers have disclosed a separate zero-day vulnerability in TP-Link's CWMP implementation that remains unpatched and affects thousands of internet-exposed devices.
Exploited flaws:
- CVE-2025-9377 (CVSS score 8.6) - OS Command Injection vulnerability in TP-Link Archer C7(EU) and TL-WR841N/ND(MS) routers. Exploitation of this vulnerability enables remote code execution when attackers manipulate the url_0 parameter, allowing complete device takeover and potential network compromise.
- CVE-2023-50224 (CVSS score 6.5) - Authentication Bypass by Spoofing vulnerability in TP-Link TL-WR841N routers. Authentication bypass vulnerability in the TL-WR841N router line that allows unauthenticated, network-adjacent attackers to access stored credentials. The flaw exists in the httpd service listening on TCP port 80, where improper authentication mechanisms enable attackers to retrieve credential pairs stored in
/tmp/dropbear/dropbearpwdand replay them in HTTP Basic authentication requests. - CVE-2020-24363 (CVSS score 8.8) - Missing Authentication for Critical Function vulnerability in TP-Link TL-WA855RE range extenders. It allows unauthenticated attackers on the local network to trigger a factory reset and reboot via a TDDP_RESET POST request. After the device reboots, attackers can set new administrative passwords and gain complete control of the device.
The exploitation campaign has been attributed to Chinese state-linked threat actors operating the Quad 7 botnet, also known as the 7777 botnet, xlogin botnet, or CovertNetwork-1658.
Organizations and users operating affected TP-Link devices should disable remote administration interfaces or restrict access to specific IP addresses, update firmware to the latest available versions and consider replacing end-of-life devices with supported alternatives where possible.
