TI-2026-53558 Aliases CVE-2026-76650 GHSA-wg9w-9v33-74xx

Pre-Authentication NULL Pointer Dereference in UPnP SOAP State Variable Query Processing in TP-Link TL-WR841N

LOW 24CWE-476Published 2026-08-28 · Updated 2026-08-31

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP state variable query requests. A specially crafted SOAP query may trigger unexpected termination or instability of the process hosting the UPnP service. Successful exploitation may result in a denial-of-service condition affecting UPnP discovery, state query, or related management functionality until the affected process is restarted or the device is rebooted.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00268 19th percentileScored 2026-11-07

Fix Fixed TL-WR841N v14 (TP-Link System Inc.): TL-WR841N(US)_V14_4.19 Build 260820 Rel.33478, TL-WR841N(EU)_V14_4.19 Build 260821 Rel.56588

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TP-Link System Inc.	TL-WR841N v14	before TL-WR841N(US)_V14_4.19 Build 260820 Rel.33478; before TL-WR841N(EU)_V14_4.19 Build 260821 Rel.56588	TL-WR841N(US)_V14_4.19 Build 260820 Rel.33478, TL-WR841N(EU)_V14_4.19 Build 260821 Rel.56588	Patch available	CNA

TL-WR841N v14 VendorTP-Link System Inc. Affected before TL-WR841N(US)_V14_4.19 Build 260820 Rel.33478; before TL-WR841N(EU)_V14_4.19 Build 260821 Rel.56588 Fixed in TL-WR841N(US)_V14_4.19 Build 260820 Rel.33478, TL-WR841N(EU)_V14_4.19 Build 260821 Rel.56588 Patch available CNA

Remediation

Fix · CNA TL-WR841N v14 (TP-Link System Inc.) Fixed in TL-WR841N(US)_V14_4.19 Build 260820 Rel.33478, TL-WR841N(EU)_V14_4.19 Build 260821 Rel.56588

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2026-08-28
TP-Link System TL-WR841N v14 — tp-link.com/us/support/faq/5270
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2026-53559 Pre-Authentication Multipart Boundary Buffer Overflow in HTTP Service in TP-Link TL-WR841NPriority LOW 24
- TI-2026-53557 Pre-Authentication NULL Pointer Dereference in UPnP SOAP Action Request Processing in TP-Link TL-WR841NPriority LOW 24
Show all 3 records → Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-76650
2026-10-03 Alias added: GHSA-wg9w-9v33-74xx

References

Patch 2

Advisory 1

https://www.tp-link.com/us/support/faq/5270/

TI-2026-65319 Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration CVSS 4.0HIGH 8.5
TI-2026-56252 Unauthenticated Account Information Disclosure in Multiple Omada Controllers CVSS 4.0MEDIUM 6.9
TI-2026-74509 Missing authorization in TP-Link Omada Controller MSP mode CVSS 4.0HIGH 7.5
TI-2025-10706 UPnP DOS in TL-WR940N V6 CVSS 4.0HIGH 7.1
TI-2026-69751 Plaintext storage of device private key in Tapo S505 firmware CVSS 4.0MEDIUM 5.4
TI-2026-53559 Pre-Authentication Multipart Boundary Buffer Overflow in HTTP Service in TP-Link TL-WR841N CVSS 4.0MEDIUM 5.3

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences