Vulnerability record · CVE-2021-41653 · published 13 November 2021
CVE-2021-41653: TP-Link TL-WR840N router PING function command injection RCE
Tp Link · Tl Wr840n Firmware
The PING diagnostic function on the TP-Link TL-WR840N EU v5 router (firmware through TL-WR840N(EU)_V5_171211) fails to sanitize the IP address input field, allowing injected commands to execute on the device. Because the flaw is remotely reachable with no authentication or user interaction, it exposes the router to full compromise.
Description
The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with network reachability, no authentication or interaction, and a very high EPSS score make this an urgent remote takeover risk for exposed devices.
What it is
The PING diagnostic function on the TP-Link TL-WR840N EU v5 router (firmware through TL-WR840N(EU)_V5_171211) fails to sanitize the IP address input field, allowing injected commands to execute on the device. Because the flaw is remotely reachable with no authentication or user interaction, it exposes the router to full compromise.
Impact
An attacker gains remote code execution on the router, which can lead to full device takeover, traffic interception or redirection, and use of the device as a foothold into the attached network.
Attack surface
Reached over the network via the router's PING function and its IP address input field; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high (0.76045, 99.5th percentile) and a public exploit reference is tagged, indicating active interest and likely availability of exploit code.
What to do
- Apply the TP-Link security advisory firmware update for the TL-WR840N EU v5; if no fixed firmware exists for the exact model, replace the device.
- Disable or block remote access to the router's web management interface and PING diagnostic function from untrusted networks.
- Restrict management access to a trusted LAN segment and change default administrative credentials.
- Segment or isolate the router from sensitive internal networks until it is patched or replaced.
- Monitor vendor advisory pages for updated firmware and end-of-support guidance for this model.
Detection
- Inspect router and perimeter logs for requests to the PING/diagnostic endpoint containing shell metacharacters (;, |, &, $(), backticks) in the IP address parameter.
- Alert on unexpected outbound connections or processes originating from the router's management IP.
- Monitor for anomalous DNS or traffic redirection behavior from the router toward internal hosts.
- Audit exposed management interfaces of TP-Link TL-WR840N devices on the network and flag any reachable from untrusted zones.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://k4m1ll0.com/cve-2021-41653.html | ExploitThird Party Advisory |
| https://www.tp-link.com/us/press/security-advisory/ | Vendor Advisory |
| https://k4m1ll0.com/cve-2021-41653.html | ExploitThird Party Advisory |
| https://www.tp-link.com/us/press/security-advisory/ | Vendor Advisory |
Track CVE-2021-41653 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-41653), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
