What is the CVSS score of CVE-2025-6151?

CVE-2025-6151 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H. EPSS exploitation probability: 0.5%.

Is there a public PoC exploit available for CVE-2025-6151?

Yes, a public proof-of-concept exploit is available for CVE-2025-6151. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2025-6151?

Within 24 hours: Inventory all affected router models in your network and isolate them from critical systems if possible. Within 7 days: Implement network segmentation to restrict administrative access to these devices and disable remote management features. Within 30 days: Develop a device replacement plan and prioritize procurement of supported router models with active security updates.

Tl Wr940n Firmware CVE-2025-6151

EUVD-2025-18451 HIGH

Buffer Overflow (CWE-119)

2025-06-17 f23511db-6c3e-4e32-a477-6aa17d310630

Buffer Overflow TP-Link Tl Wr940n Firmware

8.2

CVSS 4.0 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-119 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, buffer size validation MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	This vulnerability presents a nuanced risk profile. CVSS v4.0 score of 8.2 is elevated, but the vector reveals critical mitigating factors: AV:N (network-accessible), AC:L (low complexity), but PR:H (high privilege required) and UI:N. The PR:H requirement severely constrains exploitability—an attacker must already be authenticated with administrative credentials. Impact is primarily VA:H (availability), with no confidentiality or integrity compromise (VC:N, VI:N, SC:N, SI:N), indicating denial-of-service rather than data theft. Without EPSS data or KEV (Known Exploited Vulnerability) status provided, assessed likelihood of exploitation is low-to-moderate in practice: the high privilege barrier is a substantial control. However, this is an end-of-life product with no vendor support, meaning no patches will ever be released. For organizations still operating these devices, this represents a longer-term risk that can only be mitigated through hardware replacement.
Exploit ScenarioDerived	An attacker with legitimate administrative access (e.g., compromised credentials via phishing, insider threat, or from default credentials) navigates to the router's web interface and crafts a malicious HTTP request to /userRpm/WanSlaacCfgRpm.htm with an oversized payload in the SLAAC configuration parameters. This causes a buffer overflow in the firmware's CGI handler, corrupting adjacent memory and crashing the router (denial of service). In a worst-case scenario with favorable memory layout, this could enable code execution, though the PR:H requirement means pre-authentication is required, making worm-like propagation unlikely. Realistic attack vector involves targeted compromise of a specific organization's network infrastructure rather than widespread automated exploitation.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 14, 2026

Buffer overflow vulnerability in TP-Link TL-WR940N V4 and TL-WR841N V11 routers, exploitable remotely through the /userRpm/WanSlaacCfgRpm.htm endpoint. An attacker with high privileges can trigger memory corruption leading to availability impact (denial of service) or potential system compromise. This vulnerability affects end-of-life products no longer receiving vendor support, significantly limiting remediation options.

RemediationAI

primary: Hardware replacement; description: No patches will be released for these end-of-life products. Organizations should plan migration to current TP-Link models or alternative vendors with active security support. mitigation: Network segmentation; description: Restrict access to router management interface to trusted administrative networks only. Disable remote management (disable HTTP/HTTPS WAN access to admin interface) if supported. mitigation: Access control; description: Change default administrative credentials immediately. Ensure strong, unique passwords for all administrative accounts to reduce unauthorized access risk. mitigation: Monitoring; description: Monitor router logs for unusual administrative login attempts or configuration changes to /userRpm/WanSlaacCfgRpm.htm endpoint.

Affected VersionsENISA

TL-WR841N V11 0 ≤160325

TL-WR940N V4 0 ≤160617

TL-WR940N V4

Affected Packages

euvd tl_wr841n_v11 no fix

euvd tl_wr940n_v4 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability exists in CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow class affecting memory safety. The vulnerable endpoint /userRpm/WanSlaacCfgRpm.htm handles SLAAC (Stateless Address AutoConfiguration) configuration in IPv6, likely processing user-supplied input without proper bounds checking. TP-Link router firmware typically uses embedded Linux with custom CGI handlers; this specific file is part of the web-based management interface. The affected products are: TP-Link TL-WR940N V4 (CPE: cpe:2.3:h:tp-link:tl-wr940n:4:*:*:*:*:*:*:*) and TP-Link TL-WR841N V11 (CPE: cpe:2.3:h:tp-link:tl-wr841n:11:*:*:*:*:*:*:*). Both are residential-grade wireless routers that reached end-of-life several years ago.

Know when Tl Wr940n Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

High

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

None

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

High

Lifecycle Timeline

PoC Detected

Jul 15, 2025 - 19:15 vuln.today

Public exploit code

CVE Published

Jun 17, 2025 - 01:15 nvd

HIGH 8.2

DescriptionCVE.org

A vulnerability has been found in TP-Link TL-WR940N V4 and TL-WR841N V11. Affected by this issue is some unknown functionality of the file /userRpm/WanSlaacCfgRpm.htm, which may lead to buffer overflow. The attack may be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer.

Executive ViewAI

Why It Matters

TP-Link routers TL-WR940N V4 and TL-WR841N V11 contain a critical buffer overflow vulnerability with active public exploits and no vendor patch available. Organizations using these unsupported devices face immediate risk of remote compromise, potentially enabling network intrusion, data theft, and lateral movement.

Business Impact: High

Compensating Controls

Disable WAN SLAAC configuration feature if functionality permits. Implement network segmentation to prevent direct access to affected devices from untrusted networks. Disable remote management and limit administrative access to trusted internal networks only. Deploy IDS/IPS rules to detect buffer overflow exploitation attempts targeting /userRpm/WanSlaacCfgRpm.htm. Consider upgrading to supported TP-Link router firmware versions or replacing devices with current-generation equipment receiving active vendor support.

Threat Intelligence Overview

EPSS Score

0.5%

Top 33% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.5%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +41

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.