TP-Link has acknowledged a zero-day vulnerability affecting multiple router models, which allows for remote code execution due to a stack-based buffer overflow in its CWMP implementation. While a patch is available for European models, users are advised to change default passwords and disable CWMP if not needed until more fixes are released. Additionally, CISA has warned about previously exploited vulnerabilities in TP-Link routers that have been used by threat actors for malicious activities.

Three vulnerabilities have been identified in the TOTOLINK X6000R router firmware, including a critical unauthenticated command injection flaw that could allow remote attackers to execute arbitrary commands. Users are urged to update to the latest firmware version to mitigate these security risks, which could lead to unauthorized access and service disruptions. Palo Alto Networks offers protective solutions to help secure devices against such vulnerabilities.