Sourced tracker
TP-Link router vulnerabilities exploited in the wild
6 TP-Link flaws that CISA lists as actively exploited, with what TP-Link says about each: the firmware that fixes it, or that the model is retired and will not be patched.
Exploited TP-Link flaws, newest first
| Vulnerability | Added to KEV | Vendor status and models | Source |
|---|---|---|---|
| CVE-2025-9377TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability | 3 Sep 2025 | FixedArcher C7(EU) V2, TL-WR841N(MS) V9, TL-WR841ND(MS) V9Fix: 241108 builds, e.g. Archer C7(EU)_V2_241108 | VendorRead 18 Oct 2026 |
| CVE-2023-50224TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability | 3 Sep 2025 | FixedTL-WR841N V8-V12, TL-WR841ND V11Fix: partial: EU V11 211209, EU V12 230317; TL-WR841ND V11 unpatched | VendorRead 18 Oct 2026 |
| CVE-2020-24363TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability | 2 Sep 2025 | FixedTL-WA855RE(US) V5Fix: TL-WA855RE(US)_V5_200731 | VendorRead 18 Oct 2026 |
| CVE-2023-33538TP-Link Multiple Routers Command Injection Vulnerability | 16 Jun 2025 | Not statedTL-WR940N V2/V4, TL-WR841N V8/V10, TL-WR740N V1/V2 | VendorRead 18 Oct 2026 |
| CVE-2023-1389TP-Link Archer AX-21 Command Injection Vulnerability | 1 May 2023 | FixedArcher AX21(US) V3Fix: 1.1.4 Build 20230219 | VendorRead 18 Oct 2026 |
| CVE-2015-3035TP-Link Multiple Archer Devices Directory Traversal Vulnerability | 25 Mar 2022 | FixedArcher C7 V2Fix: Archer C7_V2_150304 | VendorRead 18 Oct 2026 |
Is your TP-Link model still supported?
TP-Link's end-of-service list for home network products (links a PDF with models and dates).
TP-Link end-of-life list Read 18 Oct 2026
What to do
- Find the model and hardware version on the label under the router.
- If the row says fixed, install that firmware or newer from TP-Link’s own support site.
- If it says replace, the vendor will not patch it: a router exposed to the internet with a flaw attackers already use should be taken offline and replaced.
- Turn off remote management from the internet unless you need it.
How this list is kept
- A row appears when CISA adds the flaw to its Known Exploited Vulnerabilities catalog: attackers are using it, not just able to. We copy CISA’s entry and re-check the catalog every week.
- The vendor status comes from the vendor’s own advisory or end-of-life notice, tied to a short sentence on that page that a script re-reads weekly.
- “Replace: no fix” means the vendor has said the model will not be patched. A router in that state stays open to the flaw for as long as it is online.
- Check the exact model and hardware version on the label under the router; vendors often fix one hardware version and retire another.
Other brands: ASUS · Cisco Small Business · D-Link · DrayTek · MikroTik · NETGEAR · Tenda · Ubiquiti · Zyxel · All routers