TP-Link vulnerabilities
- TP-Link has 286 CVE records published between 28 Oct 2023 and 28 Oct 2026, ranking #44 of 420 vendors on this site by that count.
- Of the 285 with a CVSS score, 186 (65.3%) are rated critical or high; 1 (0.3% of all) have no CVSS score.
- 6 vulnerabilities attributed to TP-Link are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog; the most recent, CVE-2023-50224, was added on 3 Sep 2025.
- None of them is marked as known to be used in ransomware campaigns.
- For the 6 KEV entries with a published CVE record, the median time from CVE publication to KEV listing is 614 days.
Records are attributed to TP-Link from the vendor named in the source records. About the data.
CVE records per year
Show data as a table
| Year | CVE records |
|---|---|
| 2017 | 0 |
| 2018 | 4 |
| 2019 | 0 |
| 2020 | 11 |
| 2021 | 3 |
| 2022 | 8 |
| 2023 | 55 |
| 2024 | 75 |
| 2025 | 33 |
| 2026 | 177 |
2026 is partial (through 28 Oct 2026), shown in a lighter bar.
| Year | Records | Critical | High | Critical or high | Not scored |
|---|---|---|---|---|---|
| 2026 | 177 | 1 | 115 | 65.5% | 0% |
| 2025 | 33 | 3 | 17 | 60.6% | 0% |
| 2024 | 75 | 4 | 46 | 66.7% | 0% |
| 2023 | 55 | 2 | 23 | 75.8% | 40% |
| 2022 | 8 | 2 | 4 | 75% | 0% |
| 2021 | 3 | 0 | 2 | 100% | 33.3% |
| 2020 | 11 | 1 | 8 | 81.8% | 0% |
| 2019 | 0 | 0 | 0 | — | — |
| 2018 | 4 | 0 | 0 | — | 100% |
| 2017 | 0 | 0 | 0 | — | — |
| Before 2017 | 1 | ||||
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Exploited vulnerabilities in CISA's KEV catalog
| CVE | Product | Name | Added | Ransomware |
|---|---|---|---|---|
| CVE-2023-50224 | TL-WR841N | TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability | 2025-09-03 | Unknown |
| CVE-2025-9377 | Multiple Routers | TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability | 2025-09-03 | Unknown |
| CVE-2020-24363 | TL-WA855RE | TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability | 2025-09-02 | Unknown |
| CVE-2023-33538 | Multiple Routers | TP-Link Multiple Routers Command Injection Vulnerability | 2025-06-16 | Unknown |
| CVE-2023-1389 | Archer AX21 | TP-Link Archer AX-21 Command Injection Vulnerability | 2023-05-01 | Unknown |
| CVE-2015-3035 | Multiple Archer Devices | TP-Link Multiple Archer Devices Directory Traversal Vulnerability | 2022-03-25 | Unknown |
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.
Highest exploit-prediction scores (EPSS)
EPSS estimates the probability that a vulnerability is exploited in the next 30 days. These are the 10 highest-scoring TP-Link records today.
| CVE | EPSS | Percentile | Severity | In KEV |
|---|---|---|---|---|
| CVE-2023-1389 | 100% | 100% | High | Yes |
| CVE-2015-3035 | 83.9% | 99.7% | High | Yes |
| CVE-2021-4045 | 72.4% | 99.4% | Critical | No |
| CVE-2024-53375 | 42.1% | 98.7% | High | No |
| CVE-2023-33538 | 41.6% | 98.7% | High | Yes |
| CVE-2020-10882 | 41.4% | 98.7% | High | No |
| CVE-2020-10884 | 39.1% | 98.6% | High | No |
| CVE-2025-9377 | 37.7% | 98.5% | High | Yes |
| CVE-2023-36355 | 31.7% | 98.3% | Not scored | No |
| CVE-2026-0652 | 23.3% | 97.8% | High | No |
Source: FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.