Main Vulnerability Database Vulnerabilities #VU111164

OS Command Injection in TP-Link products - CVE-2023-33538

Published: June 16, 2025 / Updated: June 27, 2025

Vulnerability identifier: #VU111164

CSH Severity: Critical

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-33538

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation. A remote unauthenticated attacker can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

TL-WR940N
TL-WR841N
TL-WR740N

How to mitigate CVE-2023-33538

Install updates from vendor's website.

Links to Public Exploits and PoC-codes

Exploit #11719 - CVE-2023-33538 (Python Exploit for TP-Link TL-WR940N/TL-WR841N Command Injection Vulnerability) (June 27, 2025)

External References

https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/3/TL-WR940N_TL-WR841N_userRpm_WlanNetworkRpm_Command_Injection.md

Related Security Bulletins

Remote code execution in TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2