What is the CVSS score of CVE-2025-6151?

CVE-2025-6151 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H. EPSS exploitation probability: 0.5%.

Which versions of Tl Wr940n Firmware are affected by CVE-2025-6151?

TP-Link routers TL-WR940N V4 and TL-WR841N V11 contain a critical buffer overflow vulnerability with active public exploits and no vendor patch available.

Is there a public PoC exploit available for CVE-2025-6151?

Yes, a public proof-of-concept exploit is available for CVE-2025-6151. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2025-6151?

Within 24 hours: Inventory all affected router models in your network and isolate them from critical systems if possible. Within 7 days: Implement network segmentation to restrict administrative access to these devices and disable remote management features. Within 30 days: Develop a device replacement plan and prioritize procurement of supported router models with active security updates.

Tl Wr940n Firmware CVE-2025-6151

EUVD-2025-18451 HIGH

Buffer Overflow (CWE-119)

2025-06-17 f23511db-6c3e-4e32-a477-6aa17d310630

Buffer Overflow TP-Link Tl Wr940n Firmware

8.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18451

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

PoC Detected

Jul 15, 2025 - 19:15 vuln.today

Public exploit code

CVE Published

Jun 17, 2025 - 01:15 nvd

HIGH 8.2

DescriptionCVE.org

A vulnerability has been found in TP-Link TL-WR940N V4 and TL-WR841N V11. Affected by this issue is some unknown functionality of the file /userRpm/WanSlaacCfgRpm.htm, which may lead to buffer overflow. The attack may be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Buffer overflow vulnerability in TP-Link TL-WR940N V4 and TL-WR841N V11 routers, exploitable remotely through the /userRpm/WanSlaacCfgRpm.htm endpoint. An attacker with high privileges can trigger memory corruption leading to availability impact (denial of service) or potential system compromise. This vulnerability affects end-of-life products no longer receiving vendor support, significantly limiting remediation options.

Technical ContextAI

The vulnerability exists in CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow class affecting memory safety. The vulnerable endpoint /userRpm/WanSlaacCfgRpm.htm handles SLAAC (Stateless Address AutoConfiguration) configuration in IPv6, likely processing user-supplied input without proper bounds checking. TP-Link router firmware typically uses embedded Linux with custom CGI handlers; this specific file is part of the web-based management interface. The affected products are: TP-Link TL-WR940N V4 (CPE: cpe:2.3:h:tp-link:tl-wr940n:4:*:*:*:*:*:*:*) and TP-Link TL-WR841N V11 (CPE: cpe:2.3:h:tp-link:tl-wr841n:11:*:*:*:*:*:*:*). Both are residential-grade wireless routers that reached end-of-life several years ago.

RemediationAI

primary: Hardware replacement; description: No patches will be released for these end-of-life products. Organizations should plan migration to current TP-Link models or alternative vendors with active security support. mitigation: Network segmentation; description: Restrict access to router management interface to trusted administrative networks only. Disable remote management (disable HTTP/HTTPS WAN access to admin interface) if supported. mitigation: Access control; description: Change default administrative credentials immediately. Ensure strong, unique passwords for all administrative accounts to reduce unauthorized access risk. mitigation: Monitoring; description: Monitor router logs for unusual administrative login attempts or configuration changes to /userRpm/WanSlaacCfgRpm.htm endpoint.