Read the docs
TI-2025-33623 Aliases CVE-2025-53712GHSA-xw6x-7rww-v34g

TP-Link TL-WR841N WlanNetworkRpm_AP.htm buffer overflow

Priority LOW 36CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WlanNetworkRpm_AP.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the web service and result in a denial-of-service (DoS) condition. The attack may be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00363 30th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkTL-WR841N V11up to 160325—No fix listedCNA
  • TL-WR841N V11 VendorTP-Link Affected up to 160325 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:tl-wr841n_firmware:*:*:*:*:*:*:*:*up to 160325VulnerableTP-Link
cpe:2.3:h:tp-link:tl-wr841n:11:*:*:*:*:*:*:*11Running onTP-Link
  • cpe:2.3:o:tp-link:tl-wr841n_firmware:*:*:*:*:*:*:*:* Versions up to 160325 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:tl-wr841n:11:*:*:*:*:*:*:* Versions 11 Running on ·TP-Link

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    TP-Link Systems TL-WR841N V11 — tp-link.com/us/support/faq/4569

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2025-33626 TP-Link TL-WR841N Wan6to4TunnelCfgRpm.htm buffer overflowPriority LOW 36
    • TI-2025-33625 TP-Link TL-WR841N WzdWlanSiteSurveyRpm_AP.htm buffer overflowPriority LOW 36
    • TI-2025-33624 TP-Link TL-WR841N WlanNetworkRpm_APC.htm buffer overflowPriority LOW 36
    Show all 5 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-53712
  2. 2026-10-03 Alias added: GHSA-xw6x-7rww-v34g

References

Advisory 1

  • TI-2023-16571 TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain… KEVCVSS 3.1HIGH 8.8
  • TI-2025-08589 Authenticated RCE via Parental Control command injection KEVCVSS 4.0HIGH 8.6
  • TI-2015-02672 Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317… KEVCVSS 3.1HIGH 7.5
  • TI-2023-27456 Authentication bypass by spoofing in TP-Link TL-WR841N KEVCVSS 3.1MEDIUM 6.5
  • TI-2018-08378 An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608… CVSS 3.0CRITICAL 9.8
  • TI-2026-02790 Authenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840N CVSS 4.0HIGH 8.5
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences