Command Injection in TP‑Link TL‑WR940N, TL‑WR841N, TL‑WR740N Routers (CVE‑2023‑33538)

Command Injection in TP‑Link TL‑WR940N, TL‑WR841N, TL‑WR740N Routers (CVE‑2023‑33538)

What It Is — TP‑Link routers TL‑WR940N V2/V4, TL‑WR841N V8/V10 and TL‑WR740N V1/V2 contain an unauthenticated command‑injection flaw in the /userRpm/WlanNetworkRpm component. An attacker who can reach the device’s web‑admin interface can inject OS commands and gain full control of the router.

Exploitability — The vulnerability is exploitable over the network without credentials. Public proof‑of‑concept code has been released, and the CVSS v3.1 base score is 8.8 (High).

Affected Products — TP‑Link TL‑WR940N V2/V4, TL‑WR841N V8/V10, TL‑WR740N V1/V2 (many units are already end‑of‑life or end‑of‑service).

Why It Matters for Trust & Control Assurance

• Continuous vulnerability monitoring is a core control; missing a known flaw erodes the evidence you can provide auditors.
• Demonstrable patch‑management and secure‑configuration processes satisfy a single VCF control that maps to NIST CSF 2.0, ISO 27001, and others.
• Replacing or remediating EoL devices shows due‑diligence in supply‑chain risk and protects the integrity of your network perimeter.

Recommended Actions

• Inventory all TP‑Link routers in your environment and verify firmware versions.
• Apply the latest TP‑Link firmware that addresses CVE‑2023‑33538, or isolate and de‑commission EoL units.
• Record remediation steps in your vulnerability‑management system to create auditable evidence.
• Update your secure‑configuration baseline to block access to /userRpm/WlanNetworkRpm from untrusted networks.

Source: CISA KEV – CVE‑2023‑33538