Live monitoring Updated 72-hour alert levelMajor alert Editor: Frédéric LENQUETTE
CYBERIACKCybersecurity & AI intelligence · by Frédéric LENQUETTE

Vendor

TP-Link: actively exploited vulnerabilities

6 vulnerabilities in TP-Link products are listed in CISA’s catalog of actively exploited vulnerabilities. Latest addition on September 3, 2025: CVE-2025-9377 (Multiple Routers).

Affected products

  • Multiple Routers2
  • Archer AX211
  • Multiple Archer Devices1
  • TL-WA855RE1
  • TL-WR841N1

All exploited vulnerabilities

CISA KEV catalog, newest first: each entry corresponds to observed exploitation.

2025 4 vulnerabilities

  1. CVE-2025-9377

    TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability

    NVD entryCISA catalog

  2. CVE-2023-50224

    TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability

    NVD entryCISA catalog

  3. CVE-2020-24363

    TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability

    NVD entryCISA catalog

  4. CVE-2023-33538

    TP-Link Multiple Routers Command Injection Vulnerability

    NVD entryCISA catalog

2023 1 vulnerability

  1. CVE-2023-1389

    TP-Link Archer AX-21 Command Injection Vulnerability

    NVD entryCISA catalog

2022 1 vulnerability

  1. CVE-2015-3035

    TP-Link Multiple Archer Devices Directory Traversal Vulnerability

    NVD entryCISA catalog

What to do

If your estate includes any of these products, make sure the vendor’s patches are applied, starting with the most recent vulnerabilities and those used by ransomware, then look for signs of compromise: an exploited vulnerability has often been used before it was fixed.

Additions from all vendors are tracked on the Actively exploited vulnerabilities page, updated several times a day. Sources: CISA KEV catalog (US public domain) and CERT-FR.