TL-WR940N CVE-2026-12935

Exploitation requires the router's RTSP connection-tracking (ALG) module to be active - present and enabled in the TL-WR940N v6 default configuration - and requires a LAN-side client to initiate an outbound connection to an attacker-controlled RTSP server (the UI:P / required-interaction element in the CVSS 4.0 vector); the malicious RTSP response then carries the crafted message that triggers the kernel stack overflow. No authentication to the router is needed (PR:N) and no non-default settings are required. The principal limiting factor is that the attack is not zero-click: an internal user or client must be enticed into reaching the attacker's RTSP server, so an attacker with no way to prompt such a connection cannot trigger the flaw purely on demand.

Signals are broadly consistent and point to a genuine high-priority issue rather than an inflated score. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, base 8.7) reflects a network-reachable, low-complexity, unauthenticated flaw whose only meaningful gating factor is required user/client interaction (UI:P) - a LAN client must first initiate an outbound connection to the malicious RTSP server, so exploitation is not fully automatable against an idle target. Kernel-level memory corruption gives high confidentiality, integrity and availability impact, and even the DoS floor is significant for a gateway device. No EPSS score, POC, or KEV entry was provided, so predicted exploitation probability is unquantified and there is no evidence of active exploitation; the practical bar is convincing or waiting for a victim device to reach an attacker RTSP endpoint. The UI:P requirement is the main real-world limiter and should temper urgency relative to a zero-click network flaw.

An attacker stands up a malicious RTSP server on the internet and induces a user on the target network to open a stream from it (for example via a link, embedded media, or a compromised app). As the router's kernel RTSP connection-tracking helper inspects the returning crafted RTSP message, the stack buffer overflows, crashing the device (DoS) or, with a reliable memory-corruption exploit, executing attacker code in the kernel for full router compromise. No authentication is required and default settings are sufficient, but the victim client must first initiate the connection (UI:P); no public exploit code is known at this time.