CVE-2023-33538

What it actually does

The vulnerability is an authenticated command injection flaw in the web management interface of affected TP-Link TL-WR940N, TL-WR841N, and TL-WR740N router firmware. Input handled by the /userRpm/WlanNetworkRpm component can be crafted so that operating system commands are executed by the router instead of being treated only as configuration data. Because exploitation is network-accessible, low-complexity, and requires only low-privileged authentication, a successful attacker can gain command execution with the privileges of the router web service, potentially allowing full compromise of the device, modification of configuration, traffic interception, malware installation, denial of service, and persistence.

Why it matters to the business

Compromised edge routers can be used to disrupt connectivity, redirect or observe traffic, weaken network security controls, and participate in botnets such as Mirai. Because this issue is listed in CISA KEV, has active in-the-wild exploitation, and carries a remediation due date of 2025-07-07 for covered organizations, exposed devices should be treated as high-priority risk even if they are small-office or branch devices. The affected models are common consumer and small-business routers, so organizations may have exposure in branch offices, remote sites, labs, shadow IT, or unmanaged network segments.

How an attack unfolds

An attacker first identifies an affected TP-Link router with its web management interface reachable over the network or internet. If default, reused, phished, leaked, or otherwise obtained credentials are available, the attacker authenticates with low-privileged access to the management interface. The attacker then sends a crafted request to /userRpm/WlanNetworkRpm containing shell metacharacters or command payloads that are interpreted by the router firmware. Once command execution is achieved, the attacker commonly downloads and runs malware using built-in utilities such as wget, curl, tftp, or busybox, changes DNS or firewall settings, creates persistence where possible, disables management visibility, or enrolls the device into a botnet. Public exploitation has been associated with Mirai-style activity, where compromised routers are rapidly converted into distributed denial-of-service nodes and scanning infrastructure.

How to fix it

Remove affected devices from internet exposure immediately and restrict web administration access to trusted management networks only. Upgrade to a vendor-provided firmware version that explicitly addresses this vulnerability if available for the exact hardware revision; no fixed versions were provided in the source data, so administrators should verify support status directly with TP-Link for TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2. If no fixed firmware is available, replace the device with a supported model. Change all router administrative passwords, disable remote administration, disable UPnP where not required, restrict management access with firewall rules, and review DNS, port forwarding, VPN, wireless, and firewall settings for unauthorized changes. For already exposed devices, consider factory reset followed by clean firmware installation or replacement, because router malware may not be fully visible from normal administration pages.

How to confirm the fix worked

Confirm the exact router model and hardware revision from the device label or administrative interface, then compare the installed firmware against TP-Link advisories for that hardware revision. Verify that /userRpm/WlanNetworkRpm and other management endpoints are not reachable from untrusted networks or the public internet. Confirm remote administration is disabled unless strictly required and limited by source IP. Attempt authenticated exposure testing from a controlled host to ensure the management interface cannot be reached outside approved networks. After remediation, validate that administrative credentials were changed, DNS and forwarding settings are expected, no unknown management users or services are present, and the router no longer makes unexpected outbound connections to download sites, command-and-control hosts, or high-volume scanning destinations.

Typical attack path

1. Scan for TP-Link TL-WR940N, TL-WR841N, or TL-WR740N routers with reachable web administration services.
2. Fingerprint the device model, firmware generation, and exposed management paths.
3. Authenticate to the router management interface using default, reused, stolen, or brute-forced credentials.
4. Send a crafted HTTP request to /userRpm/WlanNetworkRpm containing command injection syntax.
5. Execute shell commands on the router to verify code execution and determine processor architecture.
6. Download and execute malware or scripts using wget, curl, tftp, ftpget, or busybox.
7. Modify router settings, add persistence where supported, or join the device to a botnet such as Mirai.
8. Use the compromised router for scanning, DDoS traffic, proxying, credential attacks, or traffic manipulation.

How to detect it

Review perimeter logs, web access logs if available from the router or upstream proxy, firewall logs, NetFlow, DNS logs, and EDR/NDR telemetry for requests to /userRpm/WlanNetworkRpm followed by suspicious outbound downloads or scanning. Look for authenticated management sessions from unusual source IPs, failed or repeated login attempts, changes to DNS servers, port forwarding, remote management, firewall rules, or wireless settings, and unexpected reboots. Because many consumer-grade routers have limited logging, rely heavily on upstream firewall, DHCP, DNS, and network flow data. Indicators of prior exploitation include HTTP requests containing shell metacharacters to router management paths, outbound connections from the router to retrieve binaries or shell scripts, execution patterns involving wget/curl/tftp/busybox, high-volume outbound scanning, telnet/SSH brute-force traffic, and Mirai-style connections to unknown command-and-control infrastructure. If threat hunting for Mirai activity, inspect for repeated outbound attempts to ports commonly abused by IoT botnets, sudden spikes in traffic, and downloads of MIPS/ARM architecture binaries.

• /userRpm/WlanNetworkRpm
• GET /userRpm/WlanNetworkRpm
• POST /userRpm/WlanNetworkRpm
• ;wget
• ;curl
• ;tftp
• wget http://
• curl http://
• tftp -g
• busybox wget
• busybox tftp
• chmod +x
• /tmp/
• Mirai
• telnetd
• admin:admin
• root:root

What your security team should do

• Immediately inventory TP-Link TL-WR940N, TL-WR841N, and TL-WR740N devices, including hardware revision and firmware version.
• Prioritize internet-facing or remotely administered devices because exploitation is active in the wild and the vulnerability is in CISA KEV.
• Disable public remote administration and restrict management interfaces to trusted administrative networks or VPN-only access.
• Upgrade to fixed firmware where available; replace unsupported or end-of-life affected hardware.
• Reset administrative credentials and eliminate default or reused passwords across all affected routers.
• Review router configurations for unauthorized DNS servers, port forwards, firewall changes, VPN users, and management access changes.
• Monitor network telemetry for Mirai-like behavior, including outbound scanning, unusual telnet/SSH activity, and downloads of architecture-specific binaries.
• For devices suspected of compromise, perform factory reset and clean reconfiguration or replace the device rather than relying only on configuration review.
• Meet the KEV remediation deadline of 2025-07-07 where applicable and treat remaining exposure as an exception requiring compensating controls.