CVE-2023-33538 under attack for a year, but exploitation still unsuccessful

A critical command injection vulnerability, tracked as CVE-2023-33538, has been targeted by hackers for over a year in outdated TP-Link router models, including the TL-TL-WR940N, TL-WR740N, and TL-WR841N. Despite the vulnerability's high CVSS score of 8.8, no successful exploitation has been reported. The flaw, located in the /userRpm/WlanNetworkRpm component, has been a focus of attention since its discovery, with CISA adding it to the Known Exploited Vulnerabilities catalog in June¹. The ongoing attempts to exploit this vulnerability highlight the ongoing risk to users of these outdated router models. As the exploitation status of CVE-2023-33538 continues to evolve, it will determine whether this is a patch-now or monitor situation, making it crucial for practitioners to stay informed about the latest developments. This vulnerability's unresolved status matters to security professionals, as it may eventually be leveraged for malicious purposes, emphasizing the need for continued vigilance.