TP-Link Tl-WR740N Firmware vulnerabilities

10 CVEs affecting TP-Link Tl-WR740N Firmware, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-50224, published 2024-05-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-3035: TP-Link Multiple Archer Devices Directory Traversal Vulnerability, published 2015-04-22. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 83.9% chance of exploitation in the next 30 days. Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500…
CVE-2023-33538: TP-Link Multiple Routers Command Injection Vulnerability, published 2023-06-07. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-06-16. EPSS: 41.6% chance of exploitation in the next 30 days. TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .
CVE-2023-50224: TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability, published 2024-05-03. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2025-09-03. EPSS: 20% chance of exploitation in the next 30 days. TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected…
CVE-2014-9350, published 2014-12-08. Medium severity, CVSS 5.0. EPSS: 7.2% chance of exploitation in the next 30 days. TP-Link TL-WR740N 4 with firmware 3.17.0 Build 140520, 3.16.6 Build 130529, and 3.16.4 Build 130205 allows remote attackers to cause a denial of service (httpd crash) via vectors involving a "new"…
CVE-2023-33537, published 2023-06-07. High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days. TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a buffer overflow via the component /userRpm/FixMapCfgRpm.
CVE-2023-33536, published 2023-06-07. High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days. TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a buffer overflow via the component /userRpm/WlanMacFilterRpm.
CVE-2023-36354, published 2023-06-22. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. TP-Link TL-WR940N V4, TL-WR841N V8/V10, TL-WR740N V1/V2, TL-WR940N V2/V3, and TL-WR941ND V5/V6 were discovered to contain a buffer overflow in the component /userRpm/AccessCtrlTimeSchedRpm. This…
CVE-2023-36356, published 2023-06-22. High severity, CVSS 7.7. EPSS: 0.7% chance of exploitation in the next 30 days. TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8, TL-WR941ND V5, and TL-WR740N V1/V2 were discovered to contain a buffer read out-of-bounds via the component /userRpm/VirtualServerRpm. This vulnerability…
CVE-2020-14965, published 2020-06-23. Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days. On TP-Link TL-WR740N v4 and TL-WR740ND v4 devices, an attacker with access to the admin panel can inject HTML code and change the HTML context of the target pages and stations in the access-control…
CVE-2022-4296, published 2022-12-06. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability classified as problematic has been found in TP-Link TL-WR740N. Affected is an unknown function of the component ARP Handler. The manipulation leads to resource consumption. The attack…