TP-Link flaws being used in attacks

CISA lists 6 flaws in TP-Link products as being used in attacks, most recently on 3 Sep 2025.

What to do

1. Update every TP-Link product you use.Install the updates TP-Link offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
2. If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
3. Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.

Every flaw, newest first

1. Being used in attacksAdded by CISA on 3 Sep 2025
   TP-Link Multiple Routers
   CVE-2025-9377TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability
   TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
2. Being used in attacksAdded by CISA on 3 Sep 2025
   TP-Link TL-WR841N
   CVE-2023-50224TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability
   TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
3. Being used in attacksAdded by CISA on 2 Sep 2025
   TP-Link TL-WA855RE
   CVE-2020-24363TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability
   TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
4. Being used in attacksAdded by CISA on 16 Jun 2025
   TP-Link Multiple Routers
   CVE-2023-33538TP-Link Multiple Routers Command Injection Vulnerability
   TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
5. Being used in attacksAdded by CISA on 1 May 2023
   TP-Link Archer AX21
   CVE-2023-1389TP-Link Archer AX-21 Command Injection Vulnerability
   TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
6. Being used in attacksAdded by CISA on 25 Mar 2022
   TP-Link Multiple Archer Devices
   CVE-2015-3035TP-Link Multiple Archer Devices Directory Traversal Vulnerability
   Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD

From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. TP-Link on CISA’s site.