CVE-2023-33538 TP-Link Router Command Injection Exploit

Georg Lauenstein@gsec

•updated Apr 17, 2026•1•0•178

Detects exploitation attempts targeting CVE-2023-33538 vulnerability in TP-Link routers. Identifies HTTP GET requests to the /userRpm/WlanNetworkRpm endpoint with command injection payloads attempting to download and execute Mirai-like botnet malware.