PT-2023-3092 · Tp Link · Tp-Link Tl-Wr940N+2

Published

2023-05-22

·

Updated

2026-04-17

·

CVE-2023-33538

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions TP-Link TL-WR940N versions V2 through V4 TP-Link TL-WR841N versions V8 through V10 TP-Link TL-WR740N versions V1 through V2
Description A command injection vulnerability has been discovered in TP-Link routers, specifically in the component /userRpm/WlanNetworkRpm. This vulnerability allows attackers to execute arbitrary system commands, potentially leading to remote code execution. The vulnerability is being actively exploited, and CISA has issued an immediate alert. The estimated number of potentially affected devices is not specified, but it is known that the vulnerability affects multiple TP-Link router models, including TL-WR940N, TL-WR841N, and TL-WR740N. The ssid1 parameter in a specially crafted HTTP GET request is used to inject commands.
Recommendations For TP-Link TL-WR940N versions V2 through V4: Update to a patched version or apply vendor-recommended mitigations. For TP-Link TL-WR841N versions V8 through V10: Update to a patched version or apply vendor-recommended mitigations. For TP-Link TL-WR740N versions V1 through V2: Update to a patched version or apply vendor-recommended mitigations. As a temporary workaround, consider disabling the /userRpm/WlanNetworkRpm component until a patch is available. Restrict access to the vulnerable component to minimize the risk of exploitation. Avoid using the ssid1 parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2023-03182
CVE-2023-33538

Affected Products

Tp-Link Tl-Wr740N
Tp-Link Tl-Wr841N
Tp-Link Tl-Wr940N