Yes. CISA added CVE-2023-33538 to its Known Exploited Vulnerabilities catalogue on 16 June 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm.
What active exploitation changes about this CVE
This question is not just about whether the flaw exists, but whether it has moved from theoretical vulnerability to operational risk. CISA’s KEV listing means defenders should treat CVE-2023-33538 as an internet-relevant exploitation case, not a routine firmware issue to queue for later. For exposed routers, the immediate question is whether they are reachable from untrusted networks and whether administration is already exposed through poor segmentation.
Because the issue is command injection, the practical concern is arbitrary command execution on the device, which can turn a small perimeter appliance into a foothold for persistence, traffic interception, or lateral movement. That is why KEV matters operationally: it changes prioritisation from “patch when convenient” to “assume active abuse is plausible until proven otherwise.”
Review the official CISA KEV listing and the vendor advisory for device-specific exposure checks and remediation steps. The authoritative sources are CISA Known Exploited Vulnerabilities Catalog and CVE Program.
How to judge exposure on the affected routers
The first practical step is to confirm whether any TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, or TL-WR740N V1/V2 devices are still deployed, then determine whether they are remotely reachable or only used on a constrained internal segment. If the device is internet-facing, or if remote administration was enabled, the risk rises sharply because exploitation can occur without a trusted user workflow.
For this class of issue, asset inventory matters as much as patch status. If you cannot quickly tell which models and hardware revisions exist, you cannot credibly say the environment is safe. In practice, that means checking router inventories, change records, and any remote-management settings before assuming the issue is contained.
The most useful external references for triage are NIST National Vulnerability Database for record verification and FIRST EPSS for broader prioritisation context.
What to do if patching has to wait
If immediate remediation is not possible, isolate the router as much as the environment allows. Reduce exposure by removing internet reachability, disabling remote administration, restricting management interfaces to trusted hosts, and placing the device behind stronger segmentation. These are compensating controls, not a fix, but they can materially reduce the chance that exploitation leads to an environment-wide compromise.
When routers sit at the edge, the blast radius is often larger than teams expect. A compromised device may not just expose local traffic, it may also provide a platform for DNS manipulation, credential capture, or redirection to malicious infrastructure. That makes containment and monitoring part of the remediation plan, not a separate concern.
Use the vendor’s remediation guidance alongside the CISA KEV catalogue, and where operationally useful, treat the device as a candidate for replacement if firmware support is limited or the router no longer meets baseline security expectations.
Risk and Threat Considerations
Actively exploited router flaws are high-value because perimeter devices often sit outside normal endpoint monitoring and can be left in place for years. Command injection on a gateway device can give an attacker a durable position that is hard to notice, especially if logs are sparse or management access is rarely reviewed.
Failure mechanism: The attacker abuses the vulnerable web component to inject commands, then uses the router’s privileged position to alter traffic, maintain access, or stage follow-on activity while avoiding user-visible disruption.
Impact: Successful exploitation can expose internal traffic, weaken network trust boundaries, and create a stepping stone for broader compromise, especially where the router is used as a shared edge device.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | CISA KEV status changes vulnerability prioritisation and remediation timing. |
| Recommendation — Prioritise KEV-listed devices for accelerated remediation and risk acceptance decisions. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | The answer depends on confirming exposure and identifying affected devices. |
| SC-7 — Boundary Protection | Containment and segmentation are central when patching must wait. | |
| Recommendation — Scan and inventory routers so exposed vulnerable devices are found and tracked. Restrict router reachability and isolate management interfaces behind boundary controls. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Actively exploited firmware flaws require fast identification and remediation. |
| Recommendation — Accelerate discovery, prioritisation, and remediation of affected router assets. | ||
| MITRE ATT&CK | T1190 — Exploit Public-Facing Application | Command injection on an exposed router is a public-facing exploitation path. |
| Recommendation — Hunt for exploitation attempts against exposed management interfaces. | ||
Practitioner Guidance
What to prioritise: First confirm whether the affected models exist and whether any are remotely reachable. If they are, treat exposure as time-sensitive and remove external access before you debate whether exploitation has already occurred.
What to verify: Check for unexpected configuration changes, unusual outbound traffic, DNS tampering, and any management access that was not explicitly approved. For edge devices, absence of alerts is not evidence of safety; you need positive confirmation that the device was not used as an ingress point.
Practitioner takeaway: With a KEV-listed router command-injection flaw, the right question is not only “is it exploited in the wild?” but “is any exposed device still in a position to be abused right now?”
Related resources from NHI Mgmt Group
- Guide: IoT Security Guide
- CVE-2023-33538 (TP-Link Multiple Routers Command Injection)
- Is CVE-2023-28771 (Zyxel Multiple Firewalls OS Command Injection) being exploited in the wild?
- Is CVE-2025-9377 (TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection) being exploited in the wild?
- Is CVE-2023-20887 (Vmware Aria Operations for Networks Command Injection) being exploited in the wild?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org