New TP-Link zero-day surfaces as CISA warns other flaws are exploited

TP-Link has confirmed an unpatched zero-day affecting multiple router models, with CISA warning that other flaws have already been exploited in attacks. The zero-day was discovered by independent threat researcher Mehrun (ByteRay), who first reported it to TP-Link on 11 May 2024, and TP-Link says it is investigating the exploitability and exposure of the flaw.

A patch is reportedly developed for European models, while work is underway to adapt fixes for U.S. and other global firmware versions, with no specific date given. The vulnerability is a stack-based buffer overflow in CWMP, and could allow remote code execution via oversized SOAP SetParameterValues messages; attackers could redirect DNS or intercept traffic once a device is compromised, by default credentials or outdated firmware enabling entry.

According to CISA, two additional TP-Link flaws—CVE-2023-50224 and CVE-2025-9377—have been added to the Known Exploited Vulnerability catalog, exploited by the Quad7 botnet to compromise routers.