Td W8961N V4 0 CVE-2025-15606

Without a published CVSS score, CVSS vector, or EPSS probability score, traditional quantitative risk assessment is limited. However, contextual signals indicate moderate to elevated real-world risk: (1) The vulnerability affects widely deployed consumer network equipment (ADSL routers), (2) The attack vector is almost certainly network-based with minimal complexity (unauthenticated HTTP request), (3) The technical impact is availability loss (DoS), which is operationally significant, (4) A vendor patch is already available, suggesting the issue was severe enough to warrant rapid response, (5) The attack requires no special privileges and can be executed remotely by any network-adjacent attacker. The absence of CVSS and EPSS scores suggests this may be a recently disclosed vulnerability still undergoing formal assessment. Organizations managing TD-W8961N devices should prioritize patching due to the trivial attack surface (public-facing HTTP service) and immediate business impact (network outage).

An attacker on the same network segment (or with network access to the router's WAN IP if remote administration is enabled) crafts a malicious HTTP request with specifically formatted input designed to bypass httpd's input validation—for example, an oversized header, a null-byte injection, or a special character sequence in a request parameter. Upon submission, the httpd daemon attempts to process the malformed input, triggers an unhandled exception, and crashes. The router becomes temporarily unavailable, breaking all downstream Internet connectivity for users relying on it. The attack requires minimal skill and no authentication; a simple curl command or a custom script could trigger the DoS repeatedly, sustaining an outage for as long as the attacker continues. A network-resident or WAN-routable attacker could execute this attack with trivial complexity.