CISA Warns: TP-Link Vulnerabilities Under Active Exploitation

According to CISA, urgent warnings have been issued about critical vulnerabilities in popular TP-Link router models that are currently being actively exploited. Two flaws have been added to the Known Exploited Vulnerabilities (KEV) catalog: CVE-2025-9377, an OS command injection affecting TP-Link Archer C7(EU) and TL-WR841N/ND(MS) models, and CVE-2023-50224, an authentication bypass by spoofing affecting the TL-WR841N.

The advisory notes that CVE-2025-9377 enables attackers to execute arbitrary system commands via the Parental Control page, while CVE-2023-50224 targets the httpd service on port 80 to bypass authentication and access stored credentials. CISA has set 24 September 2025 as the mandatory remediation deadline for federal agencies, and the guidance urges immediate action for users to protect their networks.

The affected devices are described as potentially end-of-life or end-of-service, complicating remediation and increasing long-term risk. Users are advised to check model compatibility, apply vendor mitigations where available, and prioritise firmware updates or replacement to maintain network security.