Vulnerability-Lookup

GHSA-WQXH-M9G7-9PC2

Vulnerability from github – Published: 2026-08-29 00:31 – Updated: 2026-08-29 00:31

Details

Successful exploitation may result in modification or corruption of process memory, potentially leading to undefined application behavior. Arbitrary code execution, information disclosure, and denial-of-service conditions have not been demonstrated.

Severity

5.3 (Medium)


                  
                    CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-76651"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-120"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-28T22:16:53Z",
    "severity": "MODERATE"
  },
  "details": "A buffer\noverflow vulnerability exists in the embedded HTTP service\u00a0in TL-WR841N v14\u00a0when processing\nmultipart/form-data requests. Insufficient validation of an attacker-controlled\nboundary parameter may allow a remote unauthenticated attacker to submit a\ncrafted request that corrupts memory by overwriting data beyond the bounds of\nan internal buffer.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may result in modification or corruption of process memory,\npotentially leading to undefined application behavior. Arbitrary code\nexecution, information disclosure, and denial-of-service conditions have not\nbeen demonstrated.",
  "id": "GHSA-wqxh-m9g7-9pc2",
  "modified": "2026-08-29T00:31:03Z",
  "published": "2026-08-29T00:31:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76651"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/en/support/download/tl-wr841n/v14/#Firmware"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/us/support/download/tl-wr841n/v14/#Firmware"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/us/support/faq/5270"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-76651 (GCVE-0-2026-76651)

Vulnerability from cvelistv5 – Published: 2026-08-28 20:19 – Updated: 2026-08-31 18:36

Title

Pre-Authentication Multipart Boundary Buffer Overflow in HTTP Service in TP-Link TL-WR841N

Summary

A buffer overflow vulnerability exists in the embedded HTTP service in TL-WR841N v14 when processing multipart/form-data requests. Insufficient validation of an attacker-controlled boundary parameter may allow a remote unauthenticated attacker to submit a crafted request that corrupts memory by overwriting data beyond the bounds of an internal buffer. Successful exploitation may result in modification or corruption of process memory, potentially leading to undefined application behavior. Arbitrary code execution, information disclosure, and denial-of-service conditions have not been demonstrated.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-31 18:36 UTC

CWE

CWE-120 - Buffer Copy without Checking Size of Input

Assigner

TPLink mitre root

References

3 references

URL	Tags
https://www.tp-link.com/us/support/download/tl-wr…	patch
https://www.tp-link.com/en/support/download/tl-wr…	patch
https://www.tp-link.com/us/support/faq/5270/	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
TP-Link System Inc.	TL-WR841N v14	Affected: 0 , < TL-WR841N(US)_V14_4.19 Build 260820 Rel.33478 (custom) Affected: 0 , < TL-WR841N(EU)_V14_4.19 Build 260821 Rel.56588 (custom)

Credits

Jincheng Wang (@winmt) from Nanjing University of Posts and Telecommunications

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76651",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T18:36:33.966883Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-31T18:36:46.288Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "TL-WR841N v14",
          "vendor": "TP-Link System Inc.",
          "versions": [
            {
              "lessThan": "TL-WR841N(US)_V14_4.19 Build 260820 Rel.33478",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "TL-WR841N(EU)_V14_4.19 Build 260821 Rel.56588",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jincheng Wang (@winmt) from Nanjing University of Posts and Telecommunications"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan\u003eA buffer\noverflow vulnerability exists in the embedded HTTP service\u0026nbsp;\u003c/span\u003e\u003cspan\u003ein TL-WR841N v14\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003cspan\u003ewhen processing\nmultipart/form-data requests. Insufficient validation of an attacker-controlled\nboundary parameter may allow a remote unauthenticated attacker to submit a\ncrafted request that corrupts memory by overwriting data beyond the bounds of\nan internal buffer.\u003c/span\u003e\u003c/p\u003e\u003cdiv\u003e\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eSuccessful\nexploitation may result in modification or corruption of process memory,\npotentially leading to undefined application behavior. Arbitrary code\nexecution, information disclosure, and denial-of-service conditions have not\nbeen demonstrated.\u003c/p\u003e\u003c/div\u003e"
            }
          ],
          "value": "A buffer\noverflow vulnerability exists in the embedded HTTP service\u00a0in TL-WR841N v14\u00a0when processing\nmultipart/form-data requests. Insufficient validation of an attacker-controlled\nboundary parameter may allow a remote unauthenticated attacker to submit a\ncrafted request that corrupts memory by overwriting data beyond the bounds of\nan internal buffer.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may result in modification or corruption of process memory,\npotentially leading to undefined application behavior. Arbitrary code\nexecution, information disclosure, and denial-of-service conditions have not\nbeen demonstrated."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "CWE-120 Buffer Copy without Checking Size of Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T20:19:09.293Z",
        "orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "shortName": "TPLink"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/us/support/download/tl-wr841n/v14/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/tl-wr841n/v14/#Firmware"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.tp-link.com/us/support/faq/5270/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Pre-Authentication Multipart Boundary Buffer Overflow in HTTP Service in TP-Link TL-WR841N",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
    "assignerShortName": "TPLink",
    "cveId": "CVE-2026-76651",
    "datePublished": "2026-08-28T20:19:09.293Z",
    "dateReserved": "2026-08-19T15:49:30.548Z",
    "dateUpdated": "2026-08-31T18:36:46.288Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-WQXH-M9G7-9PC2

CVE-2026-76651 (GCVE-0-2026-76651)

Tags

Sightings

Nomenclature