BaseFortify

Publication date: 2023-06-07

Last updated on: 2025-10-27

Assigner: MITRE

Description

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2023-06-07

Last Modified

2025-10-27

Generated

2026-08-17

AI Q&A

2025-01-07

EPSS Evaluated

2026-06-04

NVD

CVE-2023-33538

Affected Vendors & Products

Vendor	Product	Version / Range
tp-link	tl-wr940n_firmware	*
tp-link	tl-wr940n	2.0
tp-link	tl-wr940n	4.0
tp-link	tl-wr841n_firmware	*
tp-link	tl-wr841n	8.0
tp-link	tl-wr841n	10.0
tp-link	tl-wr740n_firmware	*
tp-link	tl-wr740n	1.0
tp-link	tl-wr740n	2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability, identified as CVE-2023-33538, is a command injection issue found in certain TP-Link router models. It allows an attacker to send unauthorized commands to the router, potentially compromising its security.

Impact Analysis

If you use one of the affected TP-Link routers, this vulnerability could allow an attacker to take control of your device. This could lead to unauthorized access to your network, data theft, or other malicious activities.

Hi! I’m here to help you understand CVE-2023-33538. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70