ZeusQA
Start free

Known exploited vulnerabilities

TP-Link vulnerabilities attackers have used

Every TP-Link vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 6 TP-Link vulnerabilities as exploited in the wild, 0 of them added in the last 12 months. The most recent is CVE-2025-9377, added Sep 3, 2025. Multiple Routers has the most entries (2).

In KEV, all time
6
Added, last 12 months
0
Used in ransomware
0
New CVEs this week
0

By product

Multiple Routers (2), Archer AX21 (1), Multiple Archer Devices (1), TL-WA855RE (1), TL-WR841N (1).

Every TP-Link entry in CISA KEV

  1. CVE-2025-9377

    Added · due

    TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability

    TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue…

  2. CVE-2023-50224

    Added · due

    TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability

    TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life…

  3. CVE-2020-24363

    Added · due

    TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability

    TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot…

  4. CVE-2023-33538

    Added · due

    TP-Link Multiple Routers Command Injection Vulnerability

    TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should…

  5. CVE-2023-1389

    Added · due

    TP-Link Archer AX-21 Command Injection Vulnerability

    TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution.

  6. CVE-2015-3035

    Added · due

    TP-Link Multiple Archer Devices Directory Traversal Vulnerability

    Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works