TI-2025-14234 Aliases CVE-2025-15606 GHSA-7gjx-r4jj-vjx7

Denial of Service (DoS) in HTTPD Input Handling on TP-Link TD-W8961N

LOW 31CWE-20Published 2026-03-23 · Updated 2026-03-24

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A Denial-of-Service (DoS) vulnerability in the httpd component of TP-Link's TD-W8961N v4.0 due to improper input sanitization, allows crafted requests to trigger a processing error that causes the httpd service to crash. Successful exploitation may allow the attacker to cause service interruption, resulting in a DoS condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00306 23rd percentileScored 2026-11-07

Fix Fixed TD-W8961N v4.0 (TP-Link Systems Inc.): V4_250925

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TP-Link	TD-W8961N v4.0	before V4_250925	V4_250925	Patch available	CNA

TD-W8961N v4.0 VendorTP-Link Affected before V4_250925 Fixed in V4_250925 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:tp-link:td-w8961nd_firmware::::::::	before 250925	Vulnerable	TP-Link
cpe:2.3:h:tp-link:td-w8961n:4:::::::*	4	Running on	TP-Link

cpe:2.3:o:tp-link:td-w8961nd_firmware:*:*:*:*:*:*:*:* Versions before 250925 Vulnerable ·TP-Link
cpe:2.3:h:tp-link:td-w8961n:4:*:*:*:*:*:*:* Versions 4 Running on ·TP-Link

Remediation

Fix · CNA TD-W8961N v4.0 (TP-Link Systems Inc.) Fixed in V4_250925

Timeline

2026-10-02 Threatist record created from CVE-2025-15606
2026-10-03 Alias added: GHSA-7gjx-r4jj-vjx7

References

Patch 1

https://www.tp-link.com/en/support/download/td-w8961n/v4/#Firmware

Advisory 1

https://www.tp-link.com/us/support/faq/5028/

TI-2018-14425 TP-Link TD-W8961ND devices allow XSS via the hostname of a DHCP client. CVSS 3.0MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences