HIGH🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2023-33538

CVSS 8.8v3.1pub. 2023-06-07upd. 2025-10-27

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tp Link Tl Wr740n
HW
Tp-Link
1.02.0
Tp Link Tl Wr740n Firmware
OS
Tp-Link
all versions
Tp Link Tl Wr841n
HW
Tp-Link
10.08.0
Tp Link Tl Wr841n Firmware
OS
Tp-Link
all versions
Tp Link Tl Wr940n
HW
Tp-Link
2.04.0
Tp Link Tl Wr940n Firmware
OS
Tp-Link
all versions

CISA KEV — detailsi

Vendori: TP-Link
Producti: Multiple Routers
Added to KEVi: June 16, 2025
Remediation deadline (US Federal)i: July 7, 2025(overdue)

🇺🇸CISA KEV (original)↗

Required action (CISA)i

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA descriptioni

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

🔴