# CVE-2023-33538

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .

- Page: https://www.vulneraibility.com/cve/CVE-2023-33538
- CVSS: 8.8
- Known exploited: yes, in CISA KEV since 2025-06-16; CISA due date 2025-07-07
- EPSS: 41.61%
- Unvetted proof-of-concept code on GitHub: 3 GitHub proofs of concept (first 2025-06-22)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2025-06-16)
- Weakness: CWE-77
- Published: 2023-06-07

## Affected

- tp-link:tl-wr940n_firmware
- tp-link:tl-wr841n_firmware
- tp-link:tl-wr740n_firmware

## References

- [other] https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/3/TL-WR940N_TL-WR841N_userRpm_WlanNetworkRpm_Command_Injection.md
- [other] https://web.archive.org/web/20230609111043/https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/3/TL-WR940N_TL-WR841N_userRpm_WlanNetworkRpm_Command_Injection.md
- [other] https://www.secpod.com/blog/cisa-issues-warning-on-active-exploitation-of-tp-link-vulnerability-cve-2023-33538/
- [advisory] https://www.tp-link.com/us/support/faq/3562/
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33538

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.