CVE-2023-39471 is a high severity (CVSS 8.8) command injection in the ated_tp service of TP-Link TL-WR841N routers. A network adjacent attacker with no login could run code as root. ZDI lists fixed firmware for the TL-WR841N V14 and the TL-WR840N V6.20. The scores differ between sources.
What's affected
The NVD record lists the TL-WR841N firmware and hardware (including V14) and the TL-WR840N firmware (including 6.20). It scores the flaw 8.8 (High) with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which is adjacent network, low complexity, no privileges and no interaction.
Zero Day Initiative advisory ZDI-23-1624 scores the same flaw 7.5, with attack complexity rated high, and names the fixed firmware: TL-WR841N(US)_V14_231119 and TL-WR840N(KR)_V6.20_231121. Both are High, but the numbers differ and so do the complexity ratings. We report both.
The weakness classes are CWE-78 (OS command injection) and CWE-77 (command injection). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Log in to the router's admin page and read the firmware version, which is usually on the status or firmware upgrade page. Compare it with the fixed builds dated 19 and 21 November 2023 listed by ZDI, and check the hardware version on the label, since firmware is specific to the hardware revision.
Then consider who can reach the router's LAN or Wi-Fi side. The vector says an adjacent network is needed, so guest Wi-Fi, shared offices and open ports on the local network all count.
What to do now
- List every TP-Link TL-WR841N and TL-WR840N in use, with the hardware version.
- Download the firmware for your region and hardware version from TP-Link's support site and install it. ZDI names the 231119 build for the US V14 and the 231121 build for the Korean V6.20.
- Restrict who can join the network the router serves, and turn off guest access you do not need.
- Replace routers that no longer receive firmware updates.
- Change the router admin password after updating.
Why it matters
Command injection means a string supplied by a user is passed to a system call without validation. ZDI says the ated_tp service on the router does exactly that, and the result runs as root, the most powerful account on the device.
What makes it serious is the lack of a login. Anyone on the local network segment can try it, which includes anybody who can join a shared Wi-Fi network. Routers sit at a choke point in the network. One that an attacker controls can watch or alter traffic that passes through it. Fixing the firmware is the cure, and keeping unknown devices off the network is the second control.
Quick check
Do attackers need to be on my network?
The vector says adjacent network, so yes, they need to be on the same local network segment. They do not need a login to the router.
Why do NVD and ZDI scores differ?
NVD gives 8.8 with low attack complexity. ZDI gives 7.5 with high complexity. Both are High severity.
Sources
Last reviewed: 19 October 2026.
