Search
Find a vulnerability
Search criteria
14 vulnerabilities found for tl-wr841nd_firmware by tp-link
CVE-2025-9377 (GCVE-0-2025-9377)
Vulnerability from nvd – Published: 2025-08-29 17:30 – Updated: 2026-02-26 17:47 Unsupported When AssignedTitle
Authenticated RCE via Parental Control command injection
Summary
The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9.
This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108.
Both products have reached the status of EOL (end-of-life).
It's recommending to
purchase the new
product to ensure better performance and security. If replacement is not
an option in the short term, please use the second reference link to
download and install the patch(es).
Severity
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-03 03:55 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.tp-link.com/us/support/faq/4365/ | vendor-advisory |
| https://www.tp-link.com/us/support/faq/4308/ | patchvendor-advisory |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | Archer C7(EU) V2 |
Affected:
0 , < 241108
(date)
|
|
| TP-Link Systems Inc. | TL-WR841N/ND(MS) V9 |
Affected:
0 , < 241108
(date)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9377",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-03T03:55:24.199487Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-09-03",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9377"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T17:47:46.853Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9377"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-09-03T00:00:00.000Z",
"value": "CVE-2025-9377 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Archer C7(EU) V2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "241108",
"status": "affected",
"version": "0",
"versionType": "date"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TL-WR841N/ND(MS) V9",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "241108",
"status": "affected",
"version": "0",
"versionType": "date"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eThe authenticated remote command execution (RCE) vulnerability exists in the Parental Control page\u0026nbsp;on\u0026nbsp;TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9.\u003c/div\u003e\u003cp\u003eThis issue affects Archer C7(EU) V2: before 241108 and\u0026nbsp;TL-WR841N/ND(MS) V9: before 241108.\u003c/p\u003e\u003cp\u003eBoth products have reached the status of EOL \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e(end-of-life).\u003c/span\u003e\nIt\u0027s recommending to \n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003epurchase the new \nproduct to ensure better performance and security. If replacement is not\n an option in the short term, please use the second reference link to \ndownload and install the patch(es).\n\n\u003c/span\u003e\n\n\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page\u00a0on\u00a0TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9.\n\nThis issue affects Archer C7(EU) V2: before 241108 and\u00a0TL-WR841N/ND(MS) V9: before 241108.\n\nBoth products have reached the status of EOL (end-of-life).\nIt\u0027s recommending to \n\npurchase the new \nproduct to ensure better performance and security. If replacement is not\n an option in the short term, please use the second reference link to \ndownload and install the patch(es)."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-29T17:30:33.700Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/4365/"
},
{
"tags": [
"patch",
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/4308/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"unsupported-when-assigned"
],
"title": "Authenticated RCE via Parental Control command injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2025-9377",
"datePublished": "2025-08-29T17:30:33.700Z",
"dateReserved": "2025-08-23T00:15:09.238Z",
"dateUpdated": "2026-02-26T17:47:46.853Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-25901 (GCVE-0-2025-25901)
Vulnerability from nvd – Published: 2025-02-13 00:00 – Updated: 2025-02-20 14:44
VLAI
EPSS
VEX
Summary
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11, triggered by the dnsserver1 and dnsserver2 parameters at /userRpm/WanSlaacCfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-20 14:42 UTC
CWE
- n/a
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-25901",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-20T14:42:36.639738Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-20T14:44:22.610Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"broken-link"
],
"url": "https://github.com/2664521593/mycve/blob/main/TP-Link/BOF_in_TP-Link_TL-WR841ND-V11_5.pdf"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11, triggered by the dnsserver1 and dnsserver2 parameters at /userRpm/WanSlaacCfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-13T15:20:46.959Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/2664521593/mycve/blob/main/TP-Link/BOF_in_TP-Link_TL-WR841ND-V11_5.pdf"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-25901",
"datePublished": "2025-02-13T00:00:00.000Z",
"dateReserved": "2025-02-07T00:00:00.000Z",
"dateUpdated": "2025-02-20T14:44:22.610Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-25898 (GCVE-0-2025-25898)
Vulnerability from nvd – Published: 2025-02-13 00:00 – Updated: 2025-03-18 13:58
VLAI
EPSS
VEX
Summary
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the pskSecret parameter at /userRpm/WlanSecurityRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-14 16:46 UTC
CWE
- n/a
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-25898",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-14T16:46:02.708063Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-18T13:58:54.111Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the pskSecret parameter at /userRpm/WlanSecurityRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-13T15:26:43.207Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/2664521593/mycve/blob/main/TP-Link/BOF_in_TP-Link_TL-WR841ND-V11_1.pdf"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-25898",
"datePublished": "2025-02-13T00:00:00.000Z",
"dateReserved": "2025-02-07T00:00:00.000Z",
"dateUpdated": "2025-03-18T13:58:54.111Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-25897 (GCVE-0-2025-25897)
Vulnerability from nvd – Published: 2025-02-13 00:00 – Updated: 2025-03-18 16:05
VLAI
EPSS
VEX
Summary
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the 'ip' parameter at /userRpm/WanStaticIpV6CfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-18 16:04 UTC
CWE
- n/a
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-25897",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-18T16:04:21.823706Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-18T16:05:12.397Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the \u0027ip\u0027 parameter at /userRpm/WanStaticIpV6CfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-13T15:27:47.212Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/2664521593/mycve/blob/main/TP-Link/BOF_in_TP-Link_TL-WR841ND-V11_3.pdf"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-25897",
"datePublished": "2025-02-13T00:00:00.000Z",
"dateReserved": "2025-02-07T00:00:00.000Z",
"dateUpdated": "2025-03-18T16:05:12.397Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-9284 (GCVE-0-2024-9284)
Vulnerability from nvd – Published: 2024-09-27 16:31 – Updated: 2024-09-27 18:38
VLAI
EPSS
VEX
Title
TP-LINK TL-WR841ND popupSiteSurveyRpm.htm stack-based overflow
Summary
A vulnerability was found in TP-LINK TL-WR841ND up to 20240920. It has been rated as critical. Affected by this issue is some unknown functionality of the file /userRpm/popupSiteSurveyRpm.htm. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
6.5 (Medium)
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-27 18:29 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.278684 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.278684 | signaturepermissions-required |
| https://vuldb.com/?submit.411526 | third-party-advisory |
| https://github.com/abcdefg-png/IoT-vulnerable/blo… | exploit |
| https://www.tp-link.com/ | product |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-LINK | TL-WR841ND |
Affected:
20240920
|
|
| tp-link | tl-wr841nd_\(11.0\)_firmware |
Affected:
0 , < 20240920
(custom)
cpe:2.3:o:tp-link:tl-wr841nd_\(11.0\)_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:tp-link:tl-wr841nd_\\(11.0\\)_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "tl-wr841nd_\\(11.0\\)_firmware",
"vendor": "tp-link",
"versions": [
{
"lessThan": "20240920",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-9284",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-27T18:29:56.798651Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-27T18:38:13.225Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TL-WR841ND",
"vendor": "TP-LINK",
"versions": [
{
"status": "affected",
"version": "20240920"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "wxhwxhwxh_mie (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in TP-LINK TL-WR841ND up to 20240920. It has been rated as critical. Affected by this issue is some unknown functionality of the file /userRpm/popupSiteSurveyRpm.htm. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Eine kritische Schwachstelle wurde in TP-LINK TL-WR841ND bis 20240920 ausgemacht. Hierbei geht es um eine nicht exakt ausgemachte Funktion der Datei /userRpm/popupSiteSurveyRpm.htm. Durch Beeinflussen des Arguments ssid mit unbekannten Daten kann eine stack-based buffer overflow-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.8,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-27T16:31:04.406Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-278684 | TP-LINK TL-WR841ND popupSiteSurveyRpm.htm stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.278684"
},
{
"name": "VDB-278684 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.278684"
},
{
"name": "Submit #411526 | TP-LINK TL-WR841ND V11 Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.411526"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TP-LINK/WR-841ND/popupSiteSurveyRpm.md"
},
{
"tags": [
"product"
],
"url": "https://www.tp-link.com/"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-09-27T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-09-27T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-09-27T13:38:32.000Z",
"value": "VulDB entry last update"
}
],
"title": "TP-LINK TL-WR841ND popupSiteSurveyRpm.htm stack-based overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-9284",
"datePublished": "2024-09-27T16:31:04.406Z",
"dateReserved": "2024-09-27T11:32:46.720Z",
"dateUpdated": "2024-09-27T18:38:13.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-50224 (GCVE-0-2023-50224)
Vulnerability from nvd – Published: 2024-05-03 02:14 – Updated: 2026-09-02 17:58Title
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability
Summary
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.
Severity
6.5 (Medium)
SSVC
Exploitation: active
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-03 03:55 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
| https://www.tp-link.com/en/support/download/tl-wr… | vendor-advisory |
| https://www.tp-link.com/us/support/faq/5058/ | vendor-advisory |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
23 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link | TL-WR841N |
Affected:
3.16.9 build 200409
(custom)
Affected: V8 (custom) Affected: V9 (custom) Affected: V10 (custom) Affected: V11 (custom) Unaffected: V11_211209 (custom) Affected: V12 (custom) Unaffected: V12_230317 (custom) |
|
| TP-Link | TL-WR841ND |
Affected:
V8
(custom)
Affected: V9 (custom) Affected: V10 (custom) Affected: V11 (custom) Unaffected: V11_211209 (custom) Affected: V12 (custom) Unaffected: V12_230317 (custom) |
|
| TP-Link | TL-MR6400 |
Affected:
V1
(custom)
Affected: V2 (custom) |
|
| TP-Link | Archer C5 |
Affected:
V2
(custom)
|
|
| TP-Link | Archer C7 |
Affected:
V2
(custom)
Unaffected: V2_241108 (custom) Affected: V3 (custom) |
|
| TP-Link | TL-WDR3600 |
Affected:
V2
(custom)
|
|
| TP-Link | TL-WDR4300 |
Affected:
V1
(custom)
|
|
| TP-Link | TL-WDR3500 |
Affected:
V2
(custom)
|
|
| TP-Link | TL-WR740N |
Affected:
V4
(custom)
Affected: V5 (custom) Affected: V6 (custom) Affected: V7 (custom) |
|
| TP-Link | TL-WR741ND |
Affected:
V4
(custom)
Affected: V5 (custom) Affected: V6 (custom) |
|
| TP-Link | TL-WR749N |
Affected:
BR 6.0
(custom)
Affected: BR 7.0 (custom) |
|
| TP-Link | TL-MR3420 |
Affected:
V2
(custom)
Affected: V3 (custom) Affected: V4 (custom) |
|
| TP-Link | TL-WR1043ND |
Affected:
V2
(custom)
Affected: V3 (custom) Affected: V4 (custom) |
|
| TP-Link | TL-WR1045ND |
Affected:
RU V2
(custom)
|
|
| TP-Link | TL-WR840N |
Affected:
V2
(custom)
Affected: V3 (custom) |
|
| TP-Link | TL-WR842N |
Affected:
V2
(custom)
Affected: V3 (custom) Affected: V4 (custom) |
|
| TP-Link | TL-WR842ND |
Affected:
V2
(custom)
Affected: V3 (custom) Affected: V4 (custom) |
|
| TP-Link | TL-WR845N |
Affected:
V1
(custom)
Affected: V2 (custom) |
|
| TP-Link | TL-WR941ND |
Affected:
V5
(custom)
Affected: V6 (custom) Unaffected: V6_220610 (custom) |
|
| TP-Link | TL-WR945N |
Affected:
V1
(custom)
|
|
| TP-Link | TL-WA801ND |
Affected:
V3
(custom)
Affected: V4 (custom) |
|
| TP-Link | TL-WA901ND |
Affected:
V3
(custom)
Affected: V4 (custom) Unaffected: V4_201030 (custom) Affected: V5 (custom) Unaffected: V5_201030 (custom) |
|
| tp-link | tl-wr841n_firmware |
Affected:
0 , < 12.0
(custom)
cpe:2.3:o:tp-link:tl-wr841n_firmware:-:*:*:*:*:*:*:* |
Date Public
2023-12-19 16:08
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:tp-link:tl-wr841n_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "tl-wr841n_firmware",
"vendor": "tp-link",
"versions": [
{
"lessThan": "12.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-50224",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-03T03:55:22.977218Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-09-03",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-50224"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T23:05:19.610Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-50224"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-09-03T00:00:00.000Z",
"value": "CVE-2023-50224 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T22:09:49.801Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ZDI-23-1808",
"tags": [
"x_research-advisory",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1808/"
},
{
"name": "vendor-provided URL",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.tp-link.com/en/support/download/tl-wr841n/v12/#Firmware"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "TL-WR841N",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "3.16.9 build 200409",
"versionType": "custom"
},
{
"status": "affected",
"version": "V8",
"versionType": "custom"
},
{
"status": "affected",
"version": "V9",
"versionType": "custom"
},
{
"status": "affected",
"version": "V10",
"versionType": "custom"
},
{
"status": "affected",
"version": "V11",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "V11_211209",
"versionType": "custom"
},
{
"status": "affected",
"version": "V12",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "V12_230317",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR841ND",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V8",
"versionType": "custom"
},
{
"status": "affected",
"version": "V9",
"versionType": "custom"
},
{
"status": "affected",
"version": "V10",
"versionType": "custom"
},
{
"status": "affected",
"version": "V11",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "V11_211209",
"versionType": "custom"
},
{
"status": "affected",
"version": "V12",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "V12_230317",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-MR6400",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V1",
"versionType": "custom"
},
{
"status": "affected",
"version": "V2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "Archer C5",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "Archer C7",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V2",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "V2_241108",
"versionType": "custom"
},
{
"status": "affected",
"version": "V3",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WDR3600",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WDR4300",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WDR3500",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR740N",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V4",
"versionType": "custom"
},
{
"status": "affected",
"version": "V5",
"versionType": "custom"
},
{
"status": "affected",
"version": "V6",
"versionType": "custom"
},
{
"status": "affected",
"version": "V7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR741ND",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V4",
"versionType": "custom"
},
{
"status": "affected",
"version": "V5",
"versionType": "custom"
},
{
"status": "affected",
"version": "V6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR749N",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "BR 6.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "BR 7.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-MR3420",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V2",
"versionType": "custom"
},
{
"status": "affected",
"version": "V3",
"versionType": "custom"
},
{
"status": "affected",
"version": "V4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR1043ND",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V2",
"versionType": "custom"
},
{
"status": "affected",
"version": "V3",
"versionType": "custom"
},
{
"status": "affected",
"version": "V4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR1045ND",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "RU V2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR840N",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V2",
"versionType": "custom"
},
{
"status": "affected",
"version": "V3",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR842N",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V2",
"versionType": "custom"
},
{
"status": "affected",
"version": "V3",
"versionType": "custom"
},
{
"status": "affected",
"version": "V4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR842ND",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V2",
"versionType": "custom"
},
{
"status": "affected",
"version": "V3",
"versionType": "custom"
},
{
"status": "affected",
"version": "V4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR845N",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V1",
"versionType": "custom"
},
{
"status": "affected",
"version": "V2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR941ND",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V5",
"versionType": "custom"
},
{
"status": "affected",
"version": "V6",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "V6_220610",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR945N",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WA801ND",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V3",
"versionType": "custom"
},
{
"status": "affected",
"version": "V4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WA901ND",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V3",
"versionType": "custom"
},
{
"status": "affected",
"version": "V4",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "V4_201030",
"versionType": "custom"
},
{
"status": "affected",
"version": "V5",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "V5_201030",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2023-12-05T19:37:00.000Z",
"datePublic": "2023-12-19T16:08:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.\u003c/p\u003e"
}
],
"value": "TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290: Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T17:58:31.299Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-23-1808",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1808/"
},
{
"name": "vendor-provided URL",
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/en/support/download/tl-wr841n/v12/#Firmware"
},
{
"name": "vendor-advisory",
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5058/"
}
],
"source": {
"lang": "en",
"value": "Aleksandar Djurdjevic \u0027revengsmK\u0027"
},
"title": "TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2023-50224",
"datePublished": "2024-05-03T02:14:42.922Z",
"dateReserved": "2023-12-05T16:15:17.543Z",
"dateUpdated": "2026-09-02T17:58:31.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2015-3035 (GCVE-0-2015-3035)
Vulnerability from nvd – Published: 2015-04-17 18:00 – Updated: 2025-10-21 23:56Summary
Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.
Severity
7.5 (High)
SSVC
Exploitation: active
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-04 21:02 UTC
CWE
- n/a
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
17 references
Date Public
2015-04-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:32:21.387Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/Archer-C9_V1.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/Archer-C7_V2.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/TL-WR740N_V5.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/Archer-C5_V1.20.html#Firmware"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/131378/TP-LINK-Local-File-Disclosure.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/TL-WR841N_V9.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/TL-WR841ND_V9.html#Firmware"
},
{
"name": "20150410 SEC Consult SA-20150410-0 :: Unauthenticated Local File Disclosure in multiple TP-LINK products (CVE-2015-3035)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2015/Apr/26"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/TL-WDR3600_V1.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/TL-WDR3500_V1.html#Firmware"
},
{
"name": "74050",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/74050"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150410-0_TP-Link_Unauthenticated_local_file_disclosure_vulnerability_v10.txt"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/TL-WR741ND_V5.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/Archer-C8_V1.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/TL-WDR4300_V1.html#Firmware"
},
{
"name": "20150410 SEC Consult SA-20150410-0 :: Unauthenticated Local File Disclosure in multiple TP-LINK products (CVE-2015-3035)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/535240/100/0/threaded"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2015-3035",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-04T21:02:10.582295Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2022-03-25",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3035"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T23:56:02.932Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3035"
}
],
"timeline": [
{
"lang": "en",
"time": "2022-03-25T00:00:00.000Z",
"value": "CVE-2015-3035 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-04-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/Archer-C9_V1.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/Archer-C7_V2.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/TL-WR740N_V5.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/Archer-C5_V1.20.html#Firmware"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/131378/TP-LINK-Local-File-Disclosure.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/TL-WR841N_V9.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/TL-WR841ND_V9.html#Firmware"
},
{
"name": "20150410 SEC Consult SA-20150410-0 :: Unauthenticated Local File Disclosure in multiple TP-LINK products (CVE-2015-3035)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2015/Apr/26"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/TL-WDR3600_V1.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/TL-WDR3500_V1.html#Firmware"
},
{
"name": "74050",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/74050"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150410-0_TP-Link_Unauthenticated_local_file_disclosure_vulnerability_v10.txt"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/TL-WR741ND_V5.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/Archer-C8_V1.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/TL-WDR4300_V1.html#Firmware"
},
{
"name": "20150410 SEC Consult SA-20150410-0 :: Unauthenticated Local File Disclosure in multiple TP-LINK products (CVE-2015-3035)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/535240/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-3035",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.tp-link.com/en/download/Archer-C9_V1.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/Archer-C9_V1.html#Firmware"
},
{
"name": "http://www.tp-link.com/en/download/Archer-C7_V2.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/Archer-C7_V2.html#Firmware"
},
{
"name": "http://www.tp-link.com/en/download/TL-WR740N_V5.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/TL-WR740N_V5.html#Firmware"
},
{
"name": "http://www.tp-link.com/en/download/Archer-C5_V1.20.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/Archer-C5_V1.20.html#Firmware"
},
{
"name": "http://packetstormsecurity.com/files/131378/TP-LINK-Local-File-Disclosure.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/131378/TP-LINK-Local-File-Disclosure.html"
},
{
"name": "http://www.tp-link.com/en/download/TL-WR841N_V9.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/TL-WR841N_V9.html#Firmware"
},
{
"name": "http://www.tp-link.com/en/download/TL-WR841ND_V9.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/TL-WR841ND_V9.html#Firmware"
},
{
"name": "20150410 SEC Consult SA-20150410-0 :: Unauthenticated Local File Disclosure in multiple TP-LINK products (CVE-2015-3035)",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2015/Apr/26"
},
{
"name": "http://www.tp-link.com/en/download/TL-WDR3600_V1.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/TL-WDR3600_V1.html#Firmware"
},
{
"name": "http://www.tp-link.com/en/download/TL-WDR3500_V1.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/TL-WDR3500_V1.html#Firmware"
},
{
"name": "74050",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/74050"
},
{
"name": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150410-0_TP-Link_Unauthenticated_local_file_disclosure_vulnerability_v10.txt",
"refsource": "MISC",
"url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150410-0_TP-Link_Unauthenticated_local_file_disclosure_vulnerability_v10.txt"
},
{
"name": "http://www.tp-link.com/en/download/TL-WR741ND_V5.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/TL-WR741ND_V5.html#Firmware"
},
{
"name": "http://www.tp-link.com/en/download/Archer-C8_V1.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/Archer-C8_V1.html#Firmware"
},
{
"name": "http://www.tp-link.com/en/download/TL-WDR4300_V1.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/TL-WDR4300_V1.html#Firmware"
},
{
"name": "20150410 SEC Consult SA-20150410-0 :: Unauthenticated Local File Disclosure in multiple TP-LINK products (CVE-2015-3035)",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/535240/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-3035",
"datePublished": "2015-04-17T18:00:00.000Z",
"dateReserved": "2015-04-08T00:00:00.000Z",
"dateUpdated": "2025-10-21T23:56:02.932Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-9377 (GCVE-0-2025-9377)
Vulnerability from cvelistv5 – Published: 2025-08-29 17:30 – Updated: 2026-02-26 17:47 Unsupported When AssignedTitle
Authenticated RCE via Parental Control command injection
Summary
The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9.
This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108.
Both products have reached the status of EOL (end-of-life).
It's recommending to
purchase the new
product to ensure better performance and security. If replacement is not
an option in the short term, please use the second reference link to
download and install the patch(es).
Severity
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-03 03:55 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.tp-link.com/us/support/faq/4365/ | vendor-advisory |
| https://www.tp-link.com/us/support/faq/4308/ | patchvendor-advisory |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | Archer C7(EU) V2 |
Affected:
0 , < 241108
(date)
|
|
| TP-Link Systems Inc. | TL-WR841N/ND(MS) V9 |
Affected:
0 , < 241108
(date)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9377",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-03T03:55:24.199487Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-09-03",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9377"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T17:47:46.853Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9377"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-09-03T00:00:00.000Z",
"value": "CVE-2025-9377 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Archer C7(EU) V2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "241108",
"status": "affected",
"version": "0",
"versionType": "date"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TL-WR841N/ND(MS) V9",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "241108",
"status": "affected",
"version": "0",
"versionType": "date"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eThe authenticated remote command execution (RCE) vulnerability exists in the Parental Control page\u0026nbsp;on\u0026nbsp;TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9.\u003c/div\u003e\u003cp\u003eThis issue affects Archer C7(EU) V2: before 241108 and\u0026nbsp;TL-WR841N/ND(MS) V9: before 241108.\u003c/p\u003e\u003cp\u003eBoth products have reached the status of EOL \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e(end-of-life).\u003c/span\u003e\nIt\u0027s recommending to \n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003epurchase the new \nproduct to ensure better performance and security. If replacement is not\n an option in the short term, please use the second reference link to \ndownload and install the patch(es).\n\n\u003c/span\u003e\n\n\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page\u00a0on\u00a0TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9.\n\nThis issue affects Archer C7(EU) V2: before 241108 and\u00a0TL-WR841N/ND(MS) V9: before 241108.\n\nBoth products have reached the status of EOL (end-of-life).\nIt\u0027s recommending to \n\npurchase the new \nproduct to ensure better performance and security. If replacement is not\n an option in the short term, please use the second reference link to \ndownload and install the patch(es)."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-29T17:30:33.700Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/4365/"
},
{
"tags": [
"patch",
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/4308/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"unsupported-when-assigned"
],
"title": "Authenticated RCE via Parental Control command injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2025-9377",
"datePublished": "2025-08-29T17:30:33.700Z",
"dateReserved": "2025-08-23T00:15:09.238Z",
"dateUpdated": "2026-02-26T17:47:46.853Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-25898 (GCVE-0-2025-25898)
Vulnerability from cvelistv5 – Published: 2025-02-13 00:00 – Updated: 2025-03-18 13:58
VLAI
EPSS
VEX
Summary
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the pskSecret parameter at /userRpm/WlanSecurityRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-14 16:46 UTC
CWE
- n/a
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-25898",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-14T16:46:02.708063Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-18T13:58:54.111Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the pskSecret parameter at /userRpm/WlanSecurityRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-13T15:26:43.207Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/2664521593/mycve/blob/main/TP-Link/BOF_in_TP-Link_TL-WR841ND-V11_1.pdf"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-25898",
"datePublished": "2025-02-13T00:00:00.000Z",
"dateReserved": "2025-02-07T00:00:00.000Z",
"dateUpdated": "2025-03-18T13:58:54.111Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-25901 (GCVE-0-2025-25901)
Vulnerability from cvelistv5 – Published: 2025-02-13 00:00 – Updated: 2025-02-20 14:44
VLAI
EPSS
VEX
Summary
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11, triggered by the dnsserver1 and dnsserver2 parameters at /userRpm/WanSlaacCfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-20 14:42 UTC
CWE
- n/a
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-25901",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-20T14:42:36.639738Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-20T14:44:22.610Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"broken-link"
],
"url": "https://github.com/2664521593/mycve/blob/main/TP-Link/BOF_in_TP-Link_TL-WR841ND-V11_5.pdf"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11, triggered by the dnsserver1 and dnsserver2 parameters at /userRpm/WanSlaacCfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-13T15:20:46.959Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/2664521593/mycve/blob/main/TP-Link/BOF_in_TP-Link_TL-WR841ND-V11_5.pdf"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-25901",
"datePublished": "2025-02-13T00:00:00.000Z",
"dateReserved": "2025-02-07T00:00:00.000Z",
"dateUpdated": "2025-02-20T14:44:22.610Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-25897 (GCVE-0-2025-25897)
Vulnerability from cvelistv5 – Published: 2025-02-13 00:00 – Updated: 2025-03-18 16:05
VLAI
EPSS
VEX
Summary
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the 'ip' parameter at /userRpm/WanStaticIpV6CfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-18 16:04 UTC
CWE
- n/a
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-25897",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-18T16:04:21.823706Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-18T16:05:12.397Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the \u0027ip\u0027 parameter at /userRpm/WanStaticIpV6CfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-13T15:27:47.212Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/2664521593/mycve/blob/main/TP-Link/BOF_in_TP-Link_TL-WR841ND-V11_3.pdf"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-25897",
"datePublished": "2025-02-13T00:00:00.000Z",
"dateReserved": "2025-02-07T00:00:00.000Z",
"dateUpdated": "2025-03-18T16:05:12.397Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-9284 (GCVE-0-2024-9284)
Vulnerability from cvelistv5 – Published: 2024-09-27 16:31 – Updated: 2024-09-27 18:38
VLAI
EPSS
VEX
Title
TP-LINK TL-WR841ND popupSiteSurveyRpm.htm stack-based overflow
Summary
A vulnerability was found in TP-LINK TL-WR841ND up to 20240920. It has been rated as critical. Affected by this issue is some unknown functionality of the file /userRpm/popupSiteSurveyRpm.htm. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
6.5 (Medium)
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-27 18:29 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.278684 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.278684 | signaturepermissions-required |
| https://vuldb.com/?submit.411526 | third-party-advisory |
| https://github.com/abcdefg-png/IoT-vulnerable/blo… | exploit |
| https://www.tp-link.com/ | product |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-LINK | TL-WR841ND |
Affected:
20240920
|
|
| tp-link | tl-wr841nd_\(11.0\)_firmware |
Affected:
0 , < 20240920
(custom)
cpe:2.3:o:tp-link:tl-wr841nd_\(11.0\)_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:tp-link:tl-wr841nd_\\(11.0\\)_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "tl-wr841nd_\\(11.0\\)_firmware",
"vendor": "tp-link",
"versions": [
{
"lessThan": "20240920",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-9284",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-27T18:29:56.798651Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-27T18:38:13.225Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TL-WR841ND",
"vendor": "TP-LINK",
"versions": [
{
"status": "affected",
"version": "20240920"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "wxhwxhwxh_mie (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in TP-LINK TL-WR841ND up to 20240920. It has been rated as critical. Affected by this issue is some unknown functionality of the file /userRpm/popupSiteSurveyRpm.htm. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Eine kritische Schwachstelle wurde in TP-LINK TL-WR841ND bis 20240920 ausgemacht. Hierbei geht es um eine nicht exakt ausgemachte Funktion der Datei /userRpm/popupSiteSurveyRpm.htm. Durch Beeinflussen des Arguments ssid mit unbekannten Daten kann eine stack-based buffer overflow-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.8,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-27T16:31:04.406Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-278684 | TP-LINK TL-WR841ND popupSiteSurveyRpm.htm stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.278684"
},
{
"name": "VDB-278684 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.278684"
},
{
"name": "Submit #411526 | TP-LINK TL-WR841ND V11 Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.411526"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TP-LINK/WR-841ND/popupSiteSurveyRpm.md"
},
{
"tags": [
"product"
],
"url": "https://www.tp-link.com/"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-09-27T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-09-27T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-09-27T13:38:32.000Z",
"value": "VulDB entry last update"
}
],
"title": "TP-LINK TL-WR841ND popupSiteSurveyRpm.htm stack-based overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-9284",
"datePublished": "2024-09-27T16:31:04.406Z",
"dateReserved": "2024-09-27T11:32:46.720Z",
"dateUpdated": "2024-09-27T18:38:13.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-50224 (GCVE-0-2023-50224)
Vulnerability from cvelistv5 – Published: 2024-05-03 02:14 – Updated: 2026-09-02 17:58Title
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability
Summary
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.
Severity
6.5 (Medium)
SSVC
Exploitation: active
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-03 03:55 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
| https://www.tp-link.com/en/support/download/tl-wr… | vendor-advisory |
| https://www.tp-link.com/us/support/faq/5058/ | vendor-advisory |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
23 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link | TL-WR841N |
Affected:
3.16.9 build 200409
(custom)
Affected: V8 (custom) Affected: V9 (custom) Affected: V10 (custom) Affected: V11 (custom) Unaffected: V11_211209 (custom) Affected: V12 (custom) Unaffected: V12_230317 (custom) |
|
| TP-Link | TL-WR841ND |
Affected:
V8
(custom)
Affected: V9 (custom) Affected: V10 (custom) Affected: V11 (custom) Unaffected: V11_211209 (custom) Affected: V12 (custom) Unaffected: V12_230317 (custom) |
|
| TP-Link | TL-MR6400 |
Affected:
V1
(custom)
Affected: V2 (custom) |
|
| TP-Link | Archer C5 |
Affected:
V2
(custom)
|
|
| TP-Link | Archer C7 |
Affected:
V2
(custom)
Unaffected: V2_241108 (custom) Affected: V3 (custom) |
|
| TP-Link | TL-WDR3600 |
Affected:
V2
(custom)
|
|
| TP-Link | TL-WDR4300 |
Affected:
V1
(custom)
|
|
| TP-Link | TL-WDR3500 |
Affected:
V2
(custom)
|
|
| TP-Link | TL-WR740N |
Affected:
V4
(custom)
Affected: V5 (custom) Affected: V6 (custom) Affected: V7 (custom) |
|
| TP-Link | TL-WR741ND |
Affected:
V4
(custom)
Affected: V5 (custom) Affected: V6 (custom) |
|
| TP-Link | TL-WR749N |
Affected:
BR 6.0
(custom)
Affected: BR 7.0 (custom) |
|
| TP-Link | TL-MR3420 |
Affected:
V2
(custom)
Affected: V3 (custom) Affected: V4 (custom) |
|
| TP-Link | TL-WR1043ND |
Affected:
V2
(custom)
Affected: V3 (custom) Affected: V4 (custom) |
|
| TP-Link | TL-WR1045ND |
Affected:
RU V2
(custom)
|
|
| TP-Link | TL-WR840N |
Affected:
V2
(custom)
Affected: V3 (custom) |
|
| TP-Link | TL-WR842N |
Affected:
V2
(custom)
Affected: V3 (custom) Affected: V4 (custom) |
|
| TP-Link | TL-WR842ND |
Affected:
V2
(custom)
Affected: V3 (custom) Affected: V4 (custom) |
|
| TP-Link | TL-WR845N |
Affected:
V1
(custom)
Affected: V2 (custom) |
|
| TP-Link | TL-WR941ND |
Affected:
V5
(custom)
Affected: V6 (custom) Unaffected: V6_220610 (custom) |
|
| TP-Link | TL-WR945N |
Affected:
V1
(custom)
|
|
| TP-Link | TL-WA801ND |
Affected:
V3
(custom)
Affected: V4 (custom) |
|
| TP-Link | TL-WA901ND |
Affected:
V3
(custom)
Affected: V4 (custom) Unaffected: V4_201030 (custom) Affected: V5 (custom) Unaffected: V5_201030 (custom) |
|
| tp-link | tl-wr841n_firmware |
Affected:
0 , < 12.0
(custom)
cpe:2.3:o:tp-link:tl-wr841n_firmware:-:*:*:*:*:*:*:* |
Date Public
2023-12-19 16:08
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:tp-link:tl-wr841n_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "tl-wr841n_firmware",
"vendor": "tp-link",
"versions": [
{
"lessThan": "12.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-50224",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-03T03:55:22.977218Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-09-03",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-50224"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T23:05:19.610Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-50224"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-09-03T00:00:00.000Z",
"value": "CVE-2023-50224 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T22:09:49.801Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ZDI-23-1808",
"tags": [
"x_research-advisory",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1808/"
},
{
"name": "vendor-provided URL",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.tp-link.com/en/support/download/tl-wr841n/v12/#Firmware"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "TL-WR841N",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "3.16.9 build 200409",
"versionType": "custom"
},
{
"status": "affected",
"version": "V8",
"versionType": "custom"
},
{
"status": "affected",
"version": "V9",
"versionType": "custom"
},
{
"status": "affected",
"version": "V10",
"versionType": "custom"
},
{
"status": "affected",
"version": "V11",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "V11_211209",
"versionType": "custom"
},
{
"status": "affected",
"version": "V12",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "V12_230317",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR841ND",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V8",
"versionType": "custom"
},
{
"status": "affected",
"version": "V9",
"versionType": "custom"
},
{
"status": "affected",
"version": "V10",
"versionType": "custom"
},
{
"status": "affected",
"version": "V11",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "V11_211209",
"versionType": "custom"
},
{
"status": "affected",
"version": "V12",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "V12_230317",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-MR6400",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V1",
"versionType": "custom"
},
{
"status": "affected",
"version": "V2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "Archer C5",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "Archer C7",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V2",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "V2_241108",
"versionType": "custom"
},
{
"status": "affected",
"version": "V3",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WDR3600",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WDR4300",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WDR3500",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR740N",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V4",
"versionType": "custom"
},
{
"status": "affected",
"version": "V5",
"versionType": "custom"
},
{
"status": "affected",
"version": "V6",
"versionType": "custom"
},
{
"status": "affected",
"version": "V7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR741ND",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V4",
"versionType": "custom"
},
{
"status": "affected",
"version": "V5",
"versionType": "custom"
},
{
"status": "affected",
"version": "V6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR749N",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "BR 6.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "BR 7.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-MR3420",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V2",
"versionType": "custom"
},
{
"status": "affected",
"version": "V3",
"versionType": "custom"
},
{
"status": "affected",
"version": "V4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR1043ND",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V2",
"versionType": "custom"
},
{
"status": "affected",
"version": "V3",
"versionType": "custom"
},
{
"status": "affected",
"version": "V4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR1045ND",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "RU V2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR840N",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V2",
"versionType": "custom"
},
{
"status": "affected",
"version": "V3",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR842N",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V2",
"versionType": "custom"
},
{
"status": "affected",
"version": "V3",
"versionType": "custom"
},
{
"status": "affected",
"version": "V4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR842ND",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V2",
"versionType": "custom"
},
{
"status": "affected",
"version": "V3",
"versionType": "custom"
},
{
"status": "affected",
"version": "V4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR845N",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V1",
"versionType": "custom"
},
{
"status": "affected",
"version": "V2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR941ND",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V5",
"versionType": "custom"
},
{
"status": "affected",
"version": "V6",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "V6_220610",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WR945N",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WA801ND",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V3",
"versionType": "custom"
},
{
"status": "affected",
"version": "V4",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "TL-WA901ND",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "V3",
"versionType": "custom"
},
{
"status": "affected",
"version": "V4",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "V4_201030",
"versionType": "custom"
},
{
"status": "affected",
"version": "V5",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "V5_201030",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2023-12-05T19:37:00.000Z",
"datePublic": "2023-12-19T16:08:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.\u003c/p\u003e"
}
],
"value": "TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290: Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T17:58:31.299Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-23-1808",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1808/"
},
{
"name": "vendor-provided URL",
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/en/support/download/tl-wr841n/v12/#Firmware"
},
{
"name": "vendor-advisory",
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5058/"
}
],
"source": {
"lang": "en",
"value": "Aleksandar Djurdjevic \u0027revengsmK\u0027"
},
"title": "TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2023-50224",
"datePublished": "2024-05-03T02:14:42.922Z",
"dateReserved": "2023-12-05T16:15:17.543Z",
"dateUpdated": "2026-09-02T17:58:31.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2015-3035 (GCVE-0-2015-3035)
Vulnerability from cvelistv5 – Published: 2015-04-17 18:00 – Updated: 2025-10-21 23:56Summary
Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.
Severity
7.5 (High)
SSVC
Exploitation: active
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-04 21:02 UTC
CWE
- n/a
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
17 references
Date Public
2015-04-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:32:21.387Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/Archer-C9_V1.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/Archer-C7_V2.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/TL-WR740N_V5.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/Archer-C5_V1.20.html#Firmware"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/131378/TP-LINK-Local-File-Disclosure.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/TL-WR841N_V9.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/TL-WR841ND_V9.html#Firmware"
},
{
"name": "20150410 SEC Consult SA-20150410-0 :: Unauthenticated Local File Disclosure in multiple TP-LINK products (CVE-2015-3035)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2015/Apr/26"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/TL-WDR3600_V1.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/TL-WDR3500_V1.html#Firmware"
},
{
"name": "74050",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/74050"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150410-0_TP-Link_Unauthenticated_local_file_disclosure_vulnerability_v10.txt"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/TL-WR741ND_V5.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/Archer-C8_V1.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tp-link.com/en/download/TL-WDR4300_V1.html#Firmware"
},
{
"name": "20150410 SEC Consult SA-20150410-0 :: Unauthenticated Local File Disclosure in multiple TP-LINK products (CVE-2015-3035)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/535240/100/0/threaded"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2015-3035",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-04T21:02:10.582295Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2022-03-25",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3035"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T23:56:02.932Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3035"
}
],
"timeline": [
{
"lang": "en",
"time": "2022-03-25T00:00:00.000Z",
"value": "CVE-2015-3035 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-04-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/Archer-C9_V1.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/Archer-C7_V2.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/TL-WR740N_V5.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/Archer-C5_V1.20.html#Firmware"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/131378/TP-LINK-Local-File-Disclosure.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/TL-WR841N_V9.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/TL-WR841ND_V9.html#Firmware"
},
{
"name": "20150410 SEC Consult SA-20150410-0 :: Unauthenticated Local File Disclosure in multiple TP-LINK products (CVE-2015-3035)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2015/Apr/26"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/TL-WDR3600_V1.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/TL-WDR3500_V1.html#Firmware"
},
{
"name": "74050",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/74050"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150410-0_TP-Link_Unauthenticated_local_file_disclosure_vulnerability_v10.txt"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/TL-WR741ND_V5.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/Archer-C8_V1.html#Firmware"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tp-link.com/en/download/TL-WDR4300_V1.html#Firmware"
},
{
"name": "20150410 SEC Consult SA-20150410-0 :: Unauthenticated Local File Disclosure in multiple TP-LINK products (CVE-2015-3035)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/535240/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-3035",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.tp-link.com/en/download/Archer-C9_V1.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/Archer-C9_V1.html#Firmware"
},
{
"name": "http://www.tp-link.com/en/download/Archer-C7_V2.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/Archer-C7_V2.html#Firmware"
},
{
"name": "http://www.tp-link.com/en/download/TL-WR740N_V5.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/TL-WR740N_V5.html#Firmware"
},
{
"name": "http://www.tp-link.com/en/download/Archer-C5_V1.20.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/Archer-C5_V1.20.html#Firmware"
},
{
"name": "http://packetstormsecurity.com/files/131378/TP-LINK-Local-File-Disclosure.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/131378/TP-LINK-Local-File-Disclosure.html"
},
{
"name": "http://www.tp-link.com/en/download/TL-WR841N_V9.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/TL-WR841N_V9.html#Firmware"
},
{
"name": "http://www.tp-link.com/en/download/TL-WR841ND_V9.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/TL-WR841ND_V9.html#Firmware"
},
{
"name": "20150410 SEC Consult SA-20150410-0 :: Unauthenticated Local File Disclosure in multiple TP-LINK products (CVE-2015-3035)",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2015/Apr/26"
},
{
"name": "http://www.tp-link.com/en/download/TL-WDR3600_V1.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/TL-WDR3600_V1.html#Firmware"
},
{
"name": "http://www.tp-link.com/en/download/TL-WDR3500_V1.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/TL-WDR3500_V1.html#Firmware"
},
{
"name": "74050",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/74050"
},
{
"name": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150410-0_TP-Link_Unauthenticated_local_file_disclosure_vulnerability_v10.txt",
"refsource": "MISC",
"url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150410-0_TP-Link_Unauthenticated_local_file_disclosure_vulnerability_v10.txt"
},
{
"name": "http://www.tp-link.com/en/download/TL-WR741ND_V5.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/TL-WR741ND_V5.html#Firmware"
},
{
"name": "http://www.tp-link.com/en/download/Archer-C8_V1.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/Archer-C8_V1.html#Firmware"
},
{
"name": "http://www.tp-link.com/en/download/TL-WDR4300_V1.html#Firmware",
"refsource": "CONFIRM",
"url": "http://www.tp-link.com/en/download/TL-WDR4300_V1.html#Firmware"
},
{
"name": "20150410 SEC Consult SA-20150410-0 :: Unauthenticated Local File Disclosure in multiple TP-LINK products (CVE-2015-3035)",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/535240/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-3035",
"datePublished": "2015-04-17T18:00:00.000Z",
"dateReserved": "2015-04-08T00:00:00.000Z",
"dateUpdated": "2025-10-21T23:56:02.932Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}