The U.S. Cybersecurity and Infrastructure Safety Company (CISA) on Wednesday added two security flaws impacting TP-Hyperlink wi-fi routers to its Recognized Exploited Vulnerabilities (KEV) catalog, noting that there’s proof of them being exploited within the wild.
The vulnerabilities in query are listed under –
- CVE-2023-50224 (CVSS rating: 6.5) – An authentication bypass by spoofing vulnerability throughout the httpd service of TP-Hyperlink TL-WR841N, which listens on TCP port 80 by default, resulting in the disclosure of saved credentials in “/tmp/dropbear/dropbearpwd”
- CVE-2025-9377 (CVSS rating: 8.6) – An working system command injection vulnerability in TP-Hyperlink Archer C7(EU) V2 and TL-WR841N/ND(MS) V9 that might result in distant code execution
In line with data listed on the corporate’s web site, the next router fashions have reached end-of-life (EoL) standing –
- TL-WR841N (variations 10.0 and 11.0)
- TL-WR841ND (model 10.0)
- Archer C7 (variations 2.0 and three.0)
Nonetheless, TP-Hyperlink has launched firmware updates for the 2 vulnerabilities as of November 2024 owing to malicious exploitation exercise.
“The affected merchandise have reached their Finish-of-Service (EOS) and are not receiving energetic help, together with security updates,” the corporate mentioned. “For enhanced safety, we advocate that prospects improve to newer {hardware} to make sure optimum efficiency and security.”
There are not any public reviews explicitly referencing the exploitation of the aforementioned vulnerabilities, however TP-Hyperlink, in an advisory up to date final week, linked in-the-wild exercise to a botnet often called Quad7 (aka CovertNetwork-1658), which has been leveraged by a China-linked menace actor codenamed Storm-0940 to conduct extremely evasive password spray assaults.
In mild of energetic exploitation, Federal Civilian Govt Department (FCEB) businesses are being urged to use the required mitigations by September 24, 2025, to safe their networks.
The event comes a day after CISA positioned one other high-severity security flaw impacting TP-Hyperlink TL-WA855RE Wi-Fi Ranger Extender merchandise (CVE-2020-24363, CVSS rating: 8.8) to its Recognized Exploited Vulnerabilities (KEV) catalog, citing proof of energetic exploitation.
