CISA Warns: Actively Exploited TP-Link Router Flaws Added to KEV Catalog

According to CISA, two TP-Link router vulnerabilities have been added to the Known Exploited Vulnerabilities (KEV) Catalog, emphasising the urgency for organisations and home users to act now. The first flaw, CVE-2023-50224 (CVSS 6.5), affects the TL-WR841N router and stems from improper authentication in the httpd service, allowing network-adjacent attackers to disclose stored credentials via the device’s port 80.

The second vulnerability, CVE-2025-9377 (CVSSv4 8.6), enables remote command execution on the Parental Control page of TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9 routers, with affected firmware versions listed as Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108; both devices are now end-of-life.

TP-Link has issued a firmware update for the first flaw, and patched firmware is available for the Archer C7(EU) V2 as a workaround for the second, though longer-term support is limited due to EOL status. Federal Civilian Executive Branch agencies must remediate by 24 September 2025.