A Deep Dive Into Attempted Exploitation of CVE-2023-33538
Summary: Unit 42 observed automated scans and probes attempting to exploit CVE-2023-33538, a command injection flaw in end-of-life TP-Link Wi-Fi routers, after CISA added the CVE to its KEV Catalog in June 2025, with payloads carrying Mirai-like botnet binaries. Emulating the TL-WR940N router, researchers found the observed exploits were flawed because they injected commands into the ssid parameter rather than the vulnerable ssid1 parameter, and that exploitation requires authentication, with the firmware containing default admin credentials.
Bottom line: The vulnerability remains a practical infection vector because of widespread default IoT credentials, and TP-Link confirms the affected devices are end-of-life with no vendor patches available, so replacement with supported hardware is the only remedy.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-33538
- Related
- CVE-2023-33538: TP-Link Multiple Routers Command Injection Vulnerability Known Exploited Vulnerabilities · Jun 16, 2025Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026