TP-Link vendor intelligence

TP-Link Known Exploited Vulnerabilities

Track evidence-backed exploitation affecting TP-Link products, including the gap beyond CISA KEV, confidence assessments, sensor observations, and practical response context.

Browse TP-Link KEVs Full KEV feed

Total KEVs: 9; Known exploited vulnerabilities affecting TP-Link products
In CISA KEV: 6; Records also listed in the official catalog
Beyond CISA KEV: 3; Additional exploited CVEs absent from CISA KEV
Sensor Observed: 1; TP-Link KEV with sensor-observed exploitation activity

The catalog gap matters for TP-Link exposure

Three of the nine exploited TP-Link CVEs tracked here are not in CISA KEV. Teams relying on the official catalog alone would miss one-third of this vendor portfolio.

67%
Covered by CISA: 33%
Beyond CISA: 9
Product families

Attested TP-Link CVEs

Search the exploited-vulnerability portfolio, then narrow it to official CISA coverage or the additional records KEV Intelligence tracks beyond the catalog.

How exploitation is verified

CVE / description	Product	Confidence	CISA KEV	Added
CVE-2018-11714 An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0...	TL-WR840N, TL-WR841N	High	Beyond CISA	26 Jan 2026
CVE-2021-41653 The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a...	TL-WR840N EU v5 router	High	Beyond CISA	18 Sep 2025
CVE-2025-9377 Authenticated RCE via Parental Control command injection	Archer C7(EU) V2, TL-WR841N/ND(MS) V9	Confirmed	In CISA	01 Jun 2026
CVE-2023-50224 TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability	TL-WR841N	Confirmed	In CISA	01 Jun 2026
CVE-2020-24363 TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a...	TL-WA855RE	Confirmed	In CISA	01 Jun 2026
CVE-2023-33538 TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component...	TL-WR940N, TL-WR841N, TL-WR740N	Confirmed	In CISA	01 Jun 2026
CVE-2015-3035 Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with...	Archer C5, Archer C7, Archer C8, Archer C9, TL-WDR3500, TL-WDR3600, TL-WDR4300, TL-WR740N, TL-WR741ND, TL-WR841N, TL-WR841ND	Confirmed	In CISA	25 Mar 2022
CVE-2023-1389 TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the...	TP-Link Archer AX21 (AX1800)	Confirmed	In CISA	01 May 2023
CVE-2017-16959 The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence...	TL-WVR, TL-WAR, TL-ER, TL-R devices	High	Beyond CISA	27 Nov 2017

Showing 9 of 9 TP-Link known exploited vulnerabilities.

Recurring weakness patterns

Limitation, neutralization, and missing authentication for critical function account for five mapped occurrences across this TP-Link KEV portfolio.

Browse all KEVs →

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-306

Missing Authentication for Critical Function

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-384

Session Fixation

CWE-290

Authentication Bypass by Spoofing

Early warning alerts

Get alerts on high-impact exploitation

Receive curator-selected alerts when exploitation activity warrants attention. Each alert includes the evidence and context needed to decide what requires attention now.