Read the docs
TI-2026-53559 Aliases CVE-2026-76651GHSA-wqxh-m9g7-9pc2

Pre-Authentication Multipart Boundary Buffer Overflow in HTTP Service in TP-Link TL-WR841N

Priority LOW 24CWE-120Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A buffer overflow vulnerability exists in the embedded HTTP service in TL-WR841N v14 when processing multipart/form-data requests. Insufficient validation of an attacker-controlled boundary parameter may allow a remote unauthenticated attacker to submit a crafted request that corrupts memory by overwriting data beyond the bounds of an internal buffer. Successful exploitation may result in modification or corruption of process memory, potentially leading to undefined application behavior. Arbitrary code execution, information disclosure, and denial-of-service conditions have not been demonstrated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00444 38th percentileScored 2026-11-07
Fix Fixed TL-WR841N v14 (TP-Link System Inc.): TL-WR841N(US)_V14_4.19 Build 260820 Rel.33478, TL-WR841N(EU)_V14_4.19 Build 260821 Rel.56588

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-Link System Inc.TL-WR841N v14before TL-WR841N(US)_V14_4.19 Build 260820 Rel.33478; before TL-WR841N(EU)_V14_4.19 Build 260821 Rel.56588TL-WR841N(US)_V14_4.19 Build 260820 Rel.33478, TL-WR841N(EU)_V14_4.19 Build 260821 Rel.56588Patch availableCNA
  • TL-WR841N v14 VendorTP-Link System Inc. Affected before TL-WR841N(US)_V14_4.19 Build 260820 Rel.33478; before TL-WR841N(EU)_V14_4.19 Build 260821 Rel.56588 Fixed in TL-WR841N(US)_V14_4.19 Build 260820 Rel.33478, TL-WR841N(EU)_V14_4.19 Build 260821 Rel.56588 Patch available CNA

Remediation

  • Fix · CNA TL-WR841N v14 (TP-Link System Inc.) Fixed in TL-WR841N(US)_V14_4.19 Build 260820 Rel.33478, TL-WR841N(EU)_V14_4.19 Build 260821 Rel.56588

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    TP-Link System TL-WR841N v14 — tp-link.com/us/support/faq/5270

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-53558 Pre-Authentication NULL Pointer Dereference in UPnP SOAP State Variable Query Processing in TP-Link TL-WR841NPriority LOW 24
    • TI-2026-53557 Pre-Authentication NULL Pointer Dereference in UPnP SOAP Action Request Processing in TP-Link TL-WR841NPriority LOW 24
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76651
  2. 2026-10-03 Alias added: GHSA-wqxh-m9g7-9pc2

References

Patch 2

Advisory 1

  • TI-2026-65319 Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration CVSS 4.0HIGH 8.5
  • TI-2026-56252 Unauthenticated Account Information Disclosure in Multiple Omada Controllers CVSS 4.0MEDIUM 6.9
  • TI-2026-74509 Missing authorization in TP-Link Omada Controller MSP mode CVSS 4.0HIGH 7.5
  • TI-2025-10706 UPnP DOS in TL-WR940N V6 CVSS 4.0HIGH 7.1
  • TI-2026-69751 Plaintext storage of device private key in Tapo S505 firmware CVSS 4.0MEDIUM 5.4
  • TI-2026-53558 Pre-Authentication NULL Pointer Dereference in UPnP SOAP State Variable Query Processing in TP-Link TL-WR841N CVSS 4.0MEDIUM 5.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences