CVE-2025-53711
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2Description
A vulnerability has been found in TP-Link TL-WR841N v11, TL-WR842ND v2 and TL-WR494N v3. The vulnerability exists in the /userRpm/WlanNetworkRpm.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the web service and result in a denial-of-service (DoS) condition. The attack may be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer.
Analysis
A buffer overflow vulnerability exists in the web service of multiple TP-Link router models including TL-WR841N v11, TL-WR842ND v2, and TL-WR494N v3, caused by missing input validation in /userRpm/WlanNetworkRpm.htm. An unauthenticated remote attacker can exploit this to crash the web service and cause a denial-of-service condition. The vulnerability has a low exploitation likelihood with EPSS score of 0.06% and affects products that are no longer supported by TP-Link.
Technical Context
This vulnerability affects the web management interface of TP-Link wireless routers, specifically identified through CPE cpe:2.3:o:tp-link:tl-wr841n_firmware:*:*:*:*:*:*:*:*. The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow vulnerability class where the application fails to properly validate input parameters before processing them in the WlanNetworkRpm.htm file. This file appears to handle WLAN network configuration through the router's web interface, and the lack of bounds checking allows attackers to overflow memory buffers.
Affected Products
The vulnerability affects TP-Link TL-WR841N version 11, TL-WR842ND version 2, and TL-WR494N version 3 wireless routers as confirmed by CPE cpe:2.3:o:tp-link:tl-wr841n_firmware:*:*:*:*:*:*:*:*. These are consumer-grade wireless routers that have reached end-of-life status and are no longer supported with security updates by TP-Link. The vendor has published an advisory at https://www.tp-link.com/us/support/faq/4569/ confirming the issue affects unsupported products. Additional vulnerability details are documented at https://vuldb.com/?id.318048.
Remediation
Since these products are end-of-life and will not receive patches from TP-Link, the primary remediation is to replace affected routers with currently supported models. As confirmed in the vendor advisory at https://www.tp-link.com/us/support/faq/4569/, no firmware updates will be released. For organizations unable to immediately replace equipment, implement network segmentation to isolate vulnerable devices, restrict access to the web management interface to trusted IP addresses only, and consider disabling the web interface entirely if remote management is not required. Monitor for signs of service crashes that could indicate exploitation attempts.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today