TI-2025-08589 Aliases CVE-2025-9377 GHSA-37mx-8m3f-j8vm

Authenticated RCE via Parental Control command injection

CRITICAL 96Exploited in the wildCWE-78Published 2025-08-29 · Updated 2026-02-26

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9. This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108. Both products have reached the status of EOL (end-of-life). It's recommending to purchase the new product to ensure better performance and security. If replacement is not an option in the short term, please use the second reference link to download and install the patch(es).

Why it matters now

Exploitation Active In CISA KEV since 2025-09-03CISA due date 2025-09-24

EPSS 0.413 98th percentileScored 2026-11-07

Fix Fixed Archer C7(EU) V2 (TP-Link Systems Inc.): 241108TL-WR841N/ND(MS) V9 (TP-Link Systems Inc.): 241108

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TP-Link	Archer C7(EU) V2	before 241108	241108	Patch available	CNA
TP-Link	TL-WR841N/ND(MS) V9	before 241108	241108	Patch available	CNA

Archer C7(EU) V2 VendorTP-Link Affected before 241108 Fixed in 241108 Patch available CNA
TL-WR841N/ND(MS) V9 VendorTP-Link Affected before 241108 Fixed in 241108 Patch available CNA

CPE configurations NVD · 6

CPE	Versions	Role	Vendor
cpe:2.3:o:tp-link:tl-wr841n_firmware::::::::	before 241108	Vulnerable	TP-Link
cpe:2.3:h:tp-link:tl-wr841n:v9:::::::*	v9	Running on	TP-Link
cpe:2.3:o:tp-link:tl-wr841nd_firmware::::::::	before 241108	Vulnerable	TP-Link
cpe:2.3:h:tp-link:tl-wr841nd:9:::::::*	9	Running on	TP-Link
cpe:2.3:o:tp-link:archer_c7_firmware::::::::	before 241108	Vulnerable	TP-Link
cpe:2.3:h:tp-link:archer_c7:2.0:::::::*	2.0	Running on	TP-Link

cpe:2.3:o:tp-link:tl-wr841n_firmware:*:*:*:*:*:*:*:* Versions before 241108 Vulnerable ·TP-Link
cpe:2.3:h:tp-link:tl-wr841n:v9:*:*:*:*:*:*:* Versions v9 Running on ·TP-Link
cpe:2.3:o:tp-link:tl-wr841nd_firmware:*:*:*:*:*:*:*:* Versions before 241108 Vulnerable ·TP-Link
cpe:2.3:h:tp-link:tl-wr841nd:9:*:*:*:*:*:*:* Versions 9 Running on ·TP-Link
cpe:2.3:o:tp-link:archer_c7_firmware:*:*:*:*:*:*:*:* Versions before 241108 Vulnerable ·TP-Link
cpe:2.3:h:tp-link:archer_c7:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·TP-Link

Remediation

Fix · CNA Archer C7(EU) V2 (TP-Link Systems Inc.) Fixed in 241108
Fix · CNA TL-WR841N/ND(MS) V9 (TP-Link Systems Inc.) Fixed in 241108

Timeline

2025-09-03 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2025-9377
2026-10-03 Alias added: GHSA-37mx-8m3f-j8vm

References

Patch 1

https://www.tp-link.com/us/support/faq/4308/

Advisory 1

https://www.tp-link.com/us/support/faq/4365/

TI-2015-02672 Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317… KEVCVSS 3.1HIGH 7.5
TI-2023-27456 Authentication bypass by spoofing in TP-Link TL-WR841N KEVCVSS 3.1MEDIUM 6.5
TI-2020-18081 A password-disclosure issue in the web interface on certain TP-Link devices allows a… CVSS 3.1CRITICAL 9.8
TI-2023-20381 OS command injection in TP-Link Archer C5 CVSS 3.1HIGH 8.0
TI-2023-02475 TP-Link Archer C7v2 GET Request Parameter denial of service CVSS 3.1MEDIUM 6.5
TI-2026-04692 Use of weak cryptographic key in TP-Link Archer C7 CVSS 4.0MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences