Skip to main content

TP-Link CVE-2025-9377

HIGH
OS Command Injection (CWE-78)
2025-08-29 f23511db-6c3e-4e32-a477-6aa17d310630
8.6
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
8.6 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Mar 26, 2026 - 11:20 vuln.today
Added to CISA KEV
Nov 03, 2025 - 18:55 cisa
CISA KEV
CVE Published
Aug 29, 2025 - 18:15 nvd
HIGH 8.6

DescriptionCVE.org

The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9.

This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108.

Both products have reached the status of EOL (end-of-life). It's recommending to

purchase the new product to ensure better performance and security. If replacement is not an option in the short term, please use the second reference link to download and install the patch(es).

AnalysisAI

TP-Link Archer C7 and TL-WR841N routers contain an authenticated remote command execution vulnerability in the Parental Control page, affecting end-of-life devices with no patch available.

Technical ContextAI

The CWE-78 OS command injection in the Parental Control page allows an authenticated administrator to inject arbitrary commands through parameter values that are passed unsanitized to shell execution.

Affected ProductsAI

TP-Link Archer C7(EU) V2 before 241108 TP-Link TL-WR841N/ND(MS) V9 before 241108

RemediationAI

Replace these end-of-life devices with currently supported router models. If replacement is impossible, change default credentials and restrict admin interface access to local wired connections only.

CVE-2024-57049 CRITICAL POC
9.8 Feb 18

A vulnerability in the TP-Link Archer c20 router with firmware version V6.6_230412 and earlier permits unauthorized indi

CVE-2025-5600 CRITICAL POC
9.8 Jun 04

Buffer overflow in TOTOLINK EX1200T via setLanguageCfg. EPSS 0.52%. PoC available.

CVE-2025-6393 HIGH POC
8.8 Jun 21

CVE-2025-6393 is a critical buffer overflow vulnerability in the HTTP POST request handler of TOTOLINK routers affecting

CVE-2025-5907 HIGH POC
8.8 Jun 10

Critical buffer overflow vulnerability in TOTOLINK EX1200T routers (firmware versions up to 4.1.2cu.5232_B20210713) affe

CVE-2025-5905 HIGH POC
8.8 Jun 10

Critical buffer overflow vulnerability in TOTOLINK T10 firmware version 4.1.8cu.5207 affecting the WiFi repeater configu

CVE-2025-5904 HIGH POC
8.8 Jun 10

A critical buffer overflow vulnerability exists in TOTOLINK T10 firmware version 4.1.8cu.5207 in the setWiFiMeshName fun

CVE-2025-5903 HIGH POC
8.8 Jun 10

Critical buffer overflow vulnerability in TOTOLINK T10 firmware version 4.1.8cu.5207 affecting the setWiFiAclRules funct

CVE-2025-5902 HIGH POC
8.8 Jun 09

Critical remote buffer overflow vulnerability in TOTOLINK T10 firmware version 4.1.8cu.5207 affecting the setUpgradeFW f

CVE-2025-5792 HIGH POC
8.8 Jun 06

A buffer overflow vulnerability (CVSS 8.8). Risk factors: public PoC available.

CVE-2025-5901 HIGH POC
8.8 Jun 09

Critical buffer overflow vulnerability in TOTOLINK T10 firmware version 4.1.8cu.5207 affecting the UploadCustomModule fu

CVE-2025-6165 HIGH POC
8.8 Jun 17

Critical buffer overflow vulnerability in TOTOLINK X15 firmware (version 1.0.0-B20230714.1105) affecting the HTTP POST r

CVE-2025-6164 HIGH POC
8.8 Jun 17

Critical buffer overflow vulnerability in TOTOLINK A3002R router firmware version 4.0.0-B20230531.1404, affecting the HT

Share

CVE-2025-9377 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy