InfoSecBulletin Cybersecurity for mankind
Hackers are looking for weak TP-Link home routers to spread Mirai-like malware, taking advantage of CVE-2023-33538 in a new round of automated attacks.
Current exploit attempts have some technical problems, but researchers say the bug is real and can be dangerous when used with default passwords and outdated firmware.
Daily Cyber security update for 14.11. 2026
Huge European telecom leak exposes clients of Swedbank, SEB, airBaltic, and other companies
PHP2Shell attack exploited a Check Point 0-day to deploy malware
North Korean hackers steal more than $400 million using video images, FBI says
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
Network security appliances
It affects TL‑WR940N v2/v4, TL‑WR740N v1/v2 and TL‑WR841N v8/v10 models, all of which are now end‑of‑life and no longer receive security updates.
The flaw is in the /userRpm/WlanNetworkRpm.htm link, where the router handles Wi-Fi settings. CVE-2023-33538 is a command injection flaw in the web management interface of several legacy TP-Link Wi‑Fi routers.
Input made for the ssid1 field can go straight into a shell command without checks. This lets an attacker run any system command on the device.
Public technical papers and old proof-of-concept exploits show how this parameter is misused to run system commands on the affected firmware.
Vendor Advice and Defender Guidance
TP-Link has said that the affected models are no longer supported and will not get updates. They recommend that customers replace them with newer hardware and not use default passwords.
Once the firmware (including the web admin panel) was emulated, the toolkit created a bridged network interface.
Security alerts and CISA’s KEV entry suggest extra safety steps, like turning off remote access, separating IoT devices from important networks, and using strong, unique admin passwords.
Organizations that use security platforms can find or stop related activity by filtering URLs and DNS, preventing intrusions, and analyzing advanced malware. They do this by marking traffic that goes to known Mirai-linked infrastructure.
