CVE-2023-33538: TP-Link router web interface command injection in WlanNetworkRpm

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw is in CISA's Known Exploited Vulnerabilities catalog with public exploit code and a high EPSS score, and it allows full compromise of widely deployed edge routers.

What it is

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection flaw in the /userRpm/WlanNetworkRpm component of the router web management interface. An authenticated attacker can inject operating system commands through that endpoint, gaining control of the device. Because these are widely deployed consumer/SOHO routers, compromise gives an attacker a persistent foothold on the network edge.

Impact

An attacker with valid credentials can execute arbitrary commands on the router, leading to full device compromise, configuration changes, traffic interception, and use of the router as a pivot into the internal network. The CVSS vector rates confidentiality, integrity, and availability impact as high.

Attack surface

Reachable over the network via the router's web management interface at /userRpm/WlanNetworkRpm. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low privileges are required, meaning the attacker needs some level of authentication, but no user interaction is needed.

Exploitation

CVE-2023-33538 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2025-06-16), and public exploit code is referenced. EPSS gives a 30-day exploitation probability of about 41.9% (98.6th percentile), indicating high likelihood of active exploitation.

What to do

• Apply the vendor's firmware update or mitigation guidance from the TP-Link advisory (FAQ 3562) as soon as possible.
• If no patch is available for a given model, discontinue use or replace the device, per CISA's required action.
• Restrict access to the router web management interface to trusted management networks only; never expose it to the internet.
• Change default administrative credentials and enforce strong, unique passwords on all affected routers.
• Monitor CISA KEV guidance and apply BOD 22-01 requirements for any cloud-connected management services.

Detection

• Inspect router and upstream logs for HTTP requests to /userRpm/WlanNetworkRpm containing shell metacharacters or unexpected command strings.
• Monitor for unusual outbound connections or processes originating from affected router models.
• Audit router configuration changes and administrative logins for activity outside normal maintenance windows.
• Use network monitoring to detect command-and-control or scanning traffic sourced from the router's management IP.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.