Vendor

TP-Link

6 of 8 TP-Link CVEs in Patchfirst (75%) are in of vulnerabilities exploited in the wild.

CVEs: 8
In CISA KEV: 675%
Known ransomware use: 0
Median days to KEV: 614; from publication
Latest KEV listing: 3 Sep 2025

Watch TP-Link Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs

ProductKEVCVEs
Multiple Routers In KEV: 2 CVEs: 2
Archer AX21 In KEV: 1 CVEs: 1
Multiple Archer Devices In KEV: 1 CVEs: 1
TL-WA855RE In KEV: 1 CVEs: 1
TL-WR841N In KEV: 1 CVEs: 1
Archer AX3000 In KEV: 0 CVEs: 1
Tapo C200 In KEV: 0 CVEs: 1

Top ATT&CK techniques

What attackers do with TP-Link CVEs

TechniqueCVEs
T1190Exploit Public-Facing Application CVEs: 4
T1059Command and Scripting Interpreter CVEs: 2
T1106Native API CVEs: 1
T1496Resource Hijacking CVEs: 1
T1041Exfiltration Over C2 Channel CVEs: 1

Open in ATT&CK Navigator

A layer for MITRE’s ATT&CK Navigator: techniques scored by the highest Patchfirst priority among their CVEs, neutral to red, with the CVE ids in each comment. “Open in Navigator” loads https://patchfirst.co/navigator/vendor/tp-link.json. Or download it and in Navigator choose Open Existing Layer → Upload from local.

Counts are TP-Link CVEs linked to the technique. Each link’s provenance is on the CVE page.

TP-Link CVEs

8 CVEs, by priority

CVE-2023-1389TP-Link Archer AX-21 Command Injection Vulnerability
TP-Link · Archer AX21KEVPublic exploitHigh · 8.8T1106Native API T1070Indicator Removal+3 more
>99.9%Top 0.01%
69.2priority
CVE-2021-4045TP-LINK Tapo C200 remote code execution vulnerability
TP-Link · Tapo C200Public exploitCritical · 9.8
72.4%Top 0.56%
69.0priority
CVE-2023-33538TP-Link Multiple Routers Command Injection Vulnerability
TP-Link · Multiple RoutersKEVPublic exploitHigh · 8.8T1059Command and Scripting Interpreter T1068Exploitation for Privilege Escalation
41.6%Top 1.3%
68.9priority
CVE-2020-24363TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability
TP-Link · TL-WA855REKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing Application T1098Account Manipulation
22.2%Top 2.3%
68.7priority
CVE-2015-3035TP-Link Multiple Archer Devices Directory Traversal Vulnerability
TP-Link · Multiple Archer DevicesKEVPublic exploitHigh · 7.5T1190Exploit Public-Facing Application T1005Data from Local System
83.9%Top 0.31%
68.2priority
CVE-2025-9377TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability
TP-Link · Multiple RoutersKEVHigh · 7.2T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
41.3%Top 1.3%
62.8priority
CVE-2023-50224TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability
TP-Link · TL-WR841NKEVMedium · 6.5T1190Exploit Public-Facing Application T1552Unsecured Credentials
20.0%Top 2.6%
62.0priority
CVE-2024-21833Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute…
TP-Link · Archer AX3000High · 8.8
1.1%Top 35%
59.1priority