{"meta":{"title":"KEV entries: TP-Link","description":"All KEV entries for vendor TP-Link.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":6,"vendor":"TP-Link","entries":6,"shareOfCatalogPercent":0.3,"ransomwareKnown":0,"firstDateAdded":"2022-03-25","latestDateAdded":"2025-09-03","rank":39},"data":[{"cveID":"CVE-2025-9377","vendorProject":"TP-Link","product":"Multiple Routers","vulnerabilityName":"TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability","dateAdded":"2025-09-03","dueDate":"2025-09-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.tp-link.com/us/support/faq/4308/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-9377","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-9377"},{"cveID":"CVE-2023-50224","vendorProject":"TP-Link","product":"TL-WR841N","vulnerabilityName":"TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability","dateAdded":"2025-09-03","dueDate":"2025-09-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-290"],"shortDescription":"TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.tp-link.com/us/support/faq/4308/ ; https://nvd.nist.gov/vuln/detail/CVE-2023-50224","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2023-50224"},{"cveID":"CVE-2020-24363","vendorProject":"TP-Link","product":"TL-WA855RE","vulnerabilityName":"TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability","dateAdded":"2025-09-02","dueDate":"2025-09-23","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-306"],"shortDescription":"TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.tp-link.com/us/home-networking/range-extender/tl-wa855re/#overview ; https://www.tp-link.com/us/support/download/tl-wa855re/#FAQs ; https://nvd.nist.gov/vuln/detail/CVE-2020-24363","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2020-24363"},{"cveID":"CVE-2023-33538","vendorProject":"TP-Link","product":"Multiple Routers","vulnerabilityName":"TP-Link Multiple Routers Command Injection Vulnerability","dateAdded":"2025-06-16","dueDate":"2025-07-07","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-77"],"shortDescription":"TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.tp-link.com/nordic/support/faq/3562/ ; https://nvd.nist.gov/vuln/detail/CVE-2023-33538","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2023-33538"},{"cveID":"CVE-2023-1389","vendorProject":"TP-Link","product":"Archer AX21","vulnerabilityName":"TP-Link Archer AX-21 Command Injection Vulnerability","dateAdded":"2023-05-01","dueDate":"2023-05-22","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-77"],"shortDescription":"TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.tp-link.com/us/support/download/archer-ax21/v3/#Firmware;  https://nvd.nist.gov/vuln/detail/CVE-2023-1389","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-1389"},{"cveID":"CVE-2015-3035","vendorProject":"TP-Link","product":"Multiple Archer Devices","vulnerabilityName":"TP-Link Multiple Archer Devices Directory Traversal Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-22"],"shortDescription":"Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-3035","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-3035"}]}