InfoSecBulletin Cybersecurity for mankind
Hackers are looking for weak TP-Link home routers to spread Mirai-like malware, taking advantage of CVE-2023-33538 in a new round of automated attacks.
Current exploit attempts have some technical problems, but researchers say the bug is real and can be dangerous when used with default passwords and outdated firmware.
Crack 85 Accounts and Steal 2,500+ Records
8-Agent AI Framework Used to Compromise Gov’t Entities in Asia
270+ Zimbra servers compromised in continuous attacks
Singapore Approves 200MW Data-Centre Expansion Under Second Call
Chameleon SEO Poisoning
Hackers poison Bing and Google search results to deliver phishing banking pages
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
Network security appliances
It affects TL‑WR940N v2/v4, TL‑WR740N v1/v2 and TL‑WR841N v8/v10 models, all of which are now end‑of‑life and no longer receive security updates.
The flaw is in the /userRpm/WlanNetworkRpm.htm link, where the router handles Wi-Fi settings. CVE-2023-33538 is a command injection flaw in the web management interface of several legacy TP-Link Wi‑Fi routers.
Input made for the ssid1 field can go straight into a shell command without checks. This lets an attacker run any system command on the device.
Public technical papers and old proof-of-concept exploits show how this parameter is misused to run system commands on the affected firmware.
Vendor Advice and Defender Guidance
TP-Link has said that the affected models are no longer supported and will not get updates. They recommend that customers replace them with newer hardware and not use default passwords.
Once the firmware (including the web admin panel) was emulated, the toolkit created a bridged network interface.
Security alerts and CISA’s KEV entry suggest extra safety steps, like turning off remote access, separating IoT devices from important networks, and using strong, unique admin passwords.
Organizations that use security platforms can find or stop related activity by filtering URLs and DNS, preventing intrusions, and analyzing advanced malware. They do this by marking traffic that goes to known Mirai-linked infrastructure.
