TP-Link has issued a warning to users about two vulnerabilities affecting some end-of-life (EOL) router models; the vulnerabilities are exploiting at least two small office/home routers which are then being used to attack Microsoft 365 accounts. According to the Malwarebytes Lab blog, the routers known to be affected so far are the Archer C7 and the TL-WR841N/ND routers. Though they have reached end-of-life status, TP-Link has released firmware updates to address the vulnerabilities for users.
The two vulnerabilities are CVE-2025-50224, a flaw which allows passwords to be stolen from the router, and CVE-2025-9377, a known Parental Control common injection RCE exploit. This flaw allows attackers to run code on the router. The vulnerabilities are chained together to add vulnerable routers to a botnet. The botnet being used in these attacks is called Quad7, or 7777, and it utilizes the infected routers in password-spraying attacks against Microsoft 365 accounts.
