TP-Link Tl-WR940N Firmware vulnerabilities

22 CVEs affecting TP-Link Tl-WR940N Firmware, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-11410, published 2026-06-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-33538: TP-Link Multiple Routers Command Injection Vulnerability, published 2023-06-07. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-06-16. EPSS: 41.6% chance of exploitation in the next 30 days. TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .
CVE-2023-50224: TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability, published 2024-05-03. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2025-09-03. EPSS: 20% chance of exploitation in the next 30 days. TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected…
CVE-2023-36355, published 2023-06-22. Critical severity, CVSS 9.9. EPSS: 31.7% chance of exploitation in the next 30 days. TP-Link TL-WR940N V4 was discovered to contain a buffer overflow via the ipStart parameter at /userRpm/WanDynamicIpV6CfgRpm. This vulnerability allows attackers to cause a Denial of Service (DoS) via…
CVE-2019-6989, published 2019-06-06. High severity, CVSS 8.8. EPSS: 11.4% chance of exploitation in the next 30 days. TP-Link TL-WR940N is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the ipAddrDispose function. By sending specially crafted ICMP echo request packets, a remote…
CVE-2024-54887, published 2025-01-09. High severity, CVSS 8.0. EPSS: 6.6% chance of exploitation in the next 30 days. TP-Link TL-WR940N V3 and V4 with firmware 3.16.9 and earlier contain a buffer overflow via the dnsserver1 and dnsserver2 parameters at /userRpm/Wan6to4TunnelCfgRpm.htm. This vulnerability allows an…
CVE-2025-6151, published 2025-06-17. High severity, CVSS 8.2. EPSS: 5% chance of exploitation in the next 30 days. A vulnerability has been found in TP-Link TL-WR940N V4 and TL-WR841N V11. Affected by this issue is some unknown functionality of the file /userRpm/WanSlaacCfgRpm.htm, which may lead to buffer…
CVE-2026-11410, published 2026-06-17. High severity, CVSS 7.2. EPSS: 2.8% chance of exploitation in the next 30 days. An authenticated OS command injection vulnerability exists in the BigPond Cable (BPA) WAN configuration module in TL-WR940N v6 due to improper sanitization of user input. An attacker with…
CVE-2026-11409, published 2026-06-17. High severity, CVSS 7.2. EPSS: 2.8% chance of exploitation in the next 30 days. An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access…
CVE-2022-24355, published 2022-02-18. High severity, CVSS 8.8. EPSS: 2.1% chance of exploitation in the next 30 days. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR940N 3.20.1 Build 200316 Rel.34392n (5553) routers. Authentication is not…
CVE-2022-43636, published 2023-03-29. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of TP-Link TL-WR940N 6_211111 3.20.1(US) routers. Authentication is not required to exploit…

Latest

CVE-2023-36359, published 2023-06-22. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. TP-Link TL-WR940N V4, TL-WR841N V8/V10, TL-WR940N V2/V3 and TL-WR941ND V5/V6 were discovered to contain a buffer overflow in the component /userRpm/QoSRuleListRpm. This vulnerability allows attackers…
CVE-2023-36358, published 2023-06-22. High severity, CVSS 7.7. EPSS: 0.7% chance of exploitation in the next 30 days. TP-Link TL-WR940N V2/V3/V4, TL-WR941ND V5/V6, TL-WR743ND V1 and TL-WR841N V8 were discovered to contain a buffer overflow in the component /userRpm/AccessCtrlAccessTargetsRpm. This vulnerability…
CVE-2023-36357, published 2023-06-22. High severity, CVSS 7.7. EPSS: 0.8% chance of exploitation in the next 30 days. An issue in the /userRpm/LocalManageControlRpm component of TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8/V10, and TL-WR941ND V5 allows attackers to cause a Denial of Service (DoS) via a crafted GET…
CVE-2023-36356, published 2023-06-22. High severity, CVSS 7.7. EPSS: 0.7% chance of exploitation in the next 30 days. TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8, TL-WR941ND V5, and TL-WR740N V1/V2 were discovered to contain a buffer read out-of-bounds via the component /userRpm/VirtualServerRpm. This vulnerability…