Security News A Deep Dive Into Attempted Exploitation of CVE-2023-33538

[Gandalf_The_Grey]

Content source

https://unit42.paloaltonetworks.com/exploitation-of-cve-2023-33538/

We identified active, automated scans and probes attempting to exploit CVE-2023-33538, a vulnerability in several end-of-life TP-Link Wi-Fi router models:

• TL-WR940N v2 and v4
• TL-WR740N v1 and v2
• TL-WR841N v8 and v10

The observed payloads are malicious binaries characteristic of Mirai-like botnet malware, which the exploits attempt to download and execute on vulnerable devices.

We observed this activity after the Cybersecurity and Infrastructure Security Agency’s (CISA) June 2025 addition of this CVE (Common Vulnerabilities and Exposures) to its Known Exploited Vulnerabilities (KEV) Catalog.

There has been some discussion of how impactful (or not) these active campaigns might have been. To address this, we conducted a deep-dive investigation by emulating the TP-Link TL-WR940N router. Using firmware emulation and reverse engineering, we analyzed whether the specific exploits observed in our telemetry could successfully use this vulnerability to deliver the payload on that device model.

During our investigation, we uncovered two important facts about the attempted exploitation of this vulnerability:

• Although the in-the-wild attacks we observed were flawed and would fail, our analysis confirms the underlying vulnerability is real
• Successful exploitation requires authentication to the router's web interface

This research demonstrates that while active botnet attacks leverage flawed exploit code, the underlying vulnerability remains a practical infection vector due to the widespread use of default internet of things (IoT) credentials.

TP-Link gave the following recommendation, regarding the devices and vulnerability in question:

We confirm that the affected TP‑Link devices are end‑of‑life, and no vendor patches are available. Our recommendation to customers is to replace these units with supported hardware and ensure that default credentials are not used.

A Deep Dive Into Attempted Exploitation of CVE-2023-33538

CVE-2023-33538 allows for command injection in TP-Link routers. We discuss exploitation attempts with payloads characteristic of Mirai botnet malware.

unit42.paloaltonetworks.com

 

[Bot]

A Deep Dive Into Attempted Exploitation of CVE-2023-33538

CVE-2023-33538 allows for command injection in TP-Link routers. We discuss exploitation attempts with payloads characteristic of Mirai botnet malware.

unit42.paloaltonetworks.com

This is a useful clarification of the risk around CVE-2023-33538.

The main takeaway is that the vulnerability appears to be real, but the specific botnet exploitation attempts observed by Unit 42 were reportedly flawed and would not successfully infect the tested device in the way the attackers intended.

What matters most here

• The affected TP-Link models are end-of-life.
• TP-Link says there are no security patches available.
• Successful exploitation requires authentication to the router web interface.
• That does not make the issue harmless, because many older IoT devices are still exposed with weak or default credentials.

Why this still matters

Even if one observed exploit chain was broken, unsupported routers remain a security problem for a few reasons:

• Attackers can improve exploit code over time.
• Default or reused passwords are still common on older home routers.
• EOL devices typically have other unpatched weaknesses beyond a single CVE.
• Mirai-style campaigns do not need a perfect hit rate to be effective at scale.

So I would not treat this as “failed attack, therefore no real risk.” The better interpretation is “the current campaign was imperfect, but the exposure is still meaningful on unsupported hardware.”

Practical response for anyone still using these models

1. Replace the router with a supported model as soon as possible.
2. If replacement is not immediate, change the admin password to a strong unique one.
3. Disable remote management from the internet if it is enabled.
4. Make sure the router web interface is not exposed publicly.
5. Rebooting alone is not a fix, because it does not remove the underlying vulnerability.
6. Check for any signs of compromise, such as unknown DNS changes, unexpected port forwarding rules, or unexplained network instability.

A broader lesson

This is another example of why old consumer routers are risky to keep in service after vendor support ends. Once a device is EOL and unpatched, even a vulnerability that needs authentication can remain practical if the device is internet-exposed or still using weak credentials.

Conclusion

Unit 42’s analysis appears to lower the urgency of this exact observed exploit attempt, but it does not reduce the long-term risk of running these TP-Link EOL routers. Replacement is the correct security recommendation.

Sources

• A Deep Dive Into Attempted Exploitation of CVE-2023-33538
• CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA