The U.S. Cybersecurity and Infrastructure Safety Company (CISA) on Wednesday added two safety flaws impacting TP-Hyperlink wi-fi routers to its Identified Exploited Vulnerabilities (KEV) catalog, noting that there’s proof of them being exploited within the wild.
The vulnerabilities in query are listed under –
- CVE-2023-50224 (CVSS rating: 6.5) – An authentication bypass by spoofing vulnerability throughout the httpd service of TP-Hyperlink TL-WR841N, which listens on TCP port 80 by default, resulting in the disclosure of saved credentials in “/tmp/dropbear/dropbearpwd”
- CVE-2025-9377 (CVSS rating: 8.6) – An working system command injection vulnerability in TP-Hyperlink Archer C7(EU) V2 and TL-WR841N/ND(MS) V9 that might result in distant code execution
Based on data listed on the corporate’s web site, the next router fashions have reached end-of-life (EoL) standing –
- TL-WR841N (variations 10.0 and 11.0)
- TL-WR841ND (model 10.0)
- Archer C7 (variations 2.0 and three.0)
Nevertheless, TP-Hyperlink has launched firmware updates for the 2 vulnerabilities as of November 2024 owing to malicious exploitation exercise.
“The affected merchandise have reached their Finish-of-Service (EOS) and are now not receiving lively help, together with safety updates,” the corporate mentioned. “For enhanced safety, we advocate that prospects improve to newer {hardware} to make sure optimum efficiency and safety.”
There are not any public studies explicitly referencing the exploitation of the aforementioned vulnerabilities, however TP-Hyperlink, in an advisory up to date final week, linked in-the-wild exercise to a botnet often known as Quad7 (aka CovertNetwork-1658), which has been leveraged by a China-linked menace actor codenamed Storm-0940 to conduct extremely evasive password spray assaults.
In gentle of lively exploitation, Federal Civilian Government Department (FCEB) companies are being urged to use the required mitigations by September 24, 2025, to safe their networks.
The event comes a day after CISA positioned one other high-severity safety flaw impacting TP-Hyperlink TL-WA855RE Wi-Fi Ranger Extender merchandise (CVE-2020-24363, CVSS rating: 8.8) to its Identified Exploited Vulnerabilities (KEV) catalog, citing proof of lively exploitation.
