EUVD-2026-50449
GHSA-4j6v-4j5m-vgpq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker's RTSP server is network-reachable (AV:N) and unauthenticated (PR:N), but a LAN client must initiate the connection (UI:R); kernel-level RCE gives full C/I/A on the device.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
Lifecycle Timeline
2DescriptionCVE.org
The TL-WR940N v6 router contains a vulnerability in its RTSP connection tracking module that can lead to a stack-based buffer overflow. The issue occurs when a LAN client initiates a connection to a malicious RTSP server controlled by an attacker. A specially crafted RTSP message may trigger improper memory handling within the kernel module
Successful exploitation of this vulnerability may result in a denial-of-service (DoS) condition or allow remote code execution (RCE), potentially leading to full compromise of the device. This vulnerability can be exploited by an unauthenticated attacker under the device's default configuration.
AnalysisAI
Remote code execution and denial-of-service in the TP-Link TL-WR940N v6 router stem from a stack-based buffer overflow in the kernel-resident RTSP connection-tracking (ALG) module. An attacker who lures a LAN-side client into connecting to an attacker-controlled RTSP server can send a crafted RTSP message that the router's kernel helper mishandles, potentially yielding full device compromise. The flaw is exploitable by an unauthenticated attacker against the router's default configuration; no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
The affected component is the RTSP (Real Time Streaming Protocol) connection-tracking helper implemented as a kernel module in the TL-WR940N v6 firmware. Consumer routers commonly ship a netfilter-style RTSP ALG/conntrack helper that transparently inspects RTSP control traffic passing through NAT to open the correct data ports; parsing untrusted RTSP fields inside kernel space is inherently high-risk. The root cause is CWE-121 (Stack-based Buffer Overflow): a fixed-size stack buffer in the parser is written with attacker-controlled data from a crafted RTSP message without adequate bounds checking, corrupting the kernel stack. The CPE cpe:2.3:a:tp-link_systems_inc.:tl-wr940n_v6 identifies the single affected product line (TL-WR940N hardware revision v6).
RemediationAI
Apply the vendor-released firmware update: a patch is available per TP-Link, obtainable from the TL-WR940N v6 firmware page (https://www.tp-link.com/us/support/download/tl-wr940n/v6/#Firmware, with /en/ and /jp/ regional mirrors) and described via the advisory at https://www.tp-link.com/us/support/faq/5213/; the exact fixed build number was not included in this data, so confirm the target version against the vendor page before flashing. If patching must be deferred, reduce exposure by disabling the RTSP ALG/application-layer-gateway feature on the router if the firmware exposes that toggle (side effect: NAT traversal for streaming/IP-camera clients may break, requiring manual port forwarding), and by blocking or restricting outbound traffic to untrusted RTSP servers (typically TCP/554) from LAN clients at the gateway (side effect: legitimate external RTSP streaming will be blocked). Given the device is a home/SOHO gateway with limited on-box controls, prioritize the firmware upgrade over workarounds.
More in Tl Wr940N V6
View allAuthenticated OS command injection in the TP-Link TL-WR940N v6 router's IPv6 PPPoE configuration handler allows administ
Authenticated OS command injection in the TP-Link TL-WR940N v6 router's BigPond Cable (BPA) WAN configuration module all
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today