CISA Flags TP-Link Router Flaws CVE-2023-50224 and CVE-2025-9377 as Actively Exploited

According to CISA, two TP-Link router flaws—CVE-2023-50224 and CVE-2025-9377—are listed in the Known Exploited Vulnerabilities catalog with evidence of in‑the‑wild exploitation. CVE-2023-50224 is an authentication bypass by spoofing vulnerability in the httpd service of TP-Link TL-WR841N (default TCP port 80) that could disclose credentials stored in "/tmp/dropbear/dropbearpwd".

CVE-2025-9377 is an operating system command injection flaw affecting TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9 that could lead to remote code execution, with a CVSS score of 8.6. TP-Link has stated that the affected models are End of Life and no longer receive security updates, and has recommended upgrading to newer hardware for better protection.

There are no public reports explicitly confirming in‑the‑wild exploitation, but TP-Link’s advisory linked the activity to a botnet known as Quad7 (aka CovertNetwork-1658) used by a China‑linked threat actor codenamed Storm-0940. Agencies in the Federal Civilian Executive Branch are being urged to apply mitigations by 24 September 2025 to secure their networks.