EUVD-2026-67935
GHSA-2cvh-668x-j624
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain LAN or Wi-Fi adjacency
-
DeliveryDiscover UPnP SOAP control endpoint via SSDP
-
ExploitSend crafted SOAP action request with malformed XML
-
ExecutionTrigger NULL pointer dereference in UPnP daemon
-
PersistUPnP service crashes
-
ImpactDenial of service until restart
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The UPnP service must be enabled on the TL-WR841N v14 - UPnP is enabled by default in TP-Link consumer router firmware. The attacker must have adjacent network access, meaning they must be on the same LAN segment or wireless network as the router; internet-facing exploitation is not possible given the AV:A vector. No authentication is required to send SOAP action requests to the UPnP control interface. Exploitation is therefore limited to: (1) LAN-local or Wi-Fi-connected attackers only, and (2) devices running firmware versions before the vendor patch. The impact ceiling is UPnP service disruption - full device compromise or credential theft is not indicated. |
| Impact | The CVSS 4.0 vector AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N yields a score of 5.3 (Medium). The adjacent-only attack vector (AV:A) is the dominant risk-limiting factor: exploitation requires the attacker to already have LAN or Wi-Fi access to the same network segment as the router, ruling out direct internet-facing attacks. Impact is restricted to low availability (VA:L) - only the UPnP daemon crashes; no confidentiality or integrity compromise is possible. No EPSS data was provided and the CVE is not in CISA KEV, suggesting no observed exploitation in the wild. No POC code was referenced. The practical priority is low for most environments: the attack is self-limiting (LAN-only), the impact is partial (UPnP DoS only, not full device outage), and a vendor patch is available. The primary concern is for networks where UPnP-dependent devices (smart TVs, IoT, gaming consoles) rely on the service for port mapping, and where rogue or compromised LAN devices exist. |
| Exploit ScenarioDerived | An attacker who has gained access to the LAN - whether via a compromised device, rogue Wi-Fi connection, or physical access - sends a crafted HTTP SOAP action request to the TL-WR841N v14's UPnP control URL containing unexpected or malformed XML content. The UPnP daemon dereferences a null pointer while parsing the request, crashes, and UPnP port-mapping functionality becomes unavailable to all LAN clients until the service restarts or the device reboots. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
NULL pointer dereference in the UPnP SOAP request handler of the TP-Link TL-WR841N v14 allows an adjacent-network attacker to crash the UPnP daemon by sending a crafted SOAP action request with unexpected XML content, producing a denial-of-service condition until the service is restarted or the device rebooted. Impact is confined to UPnP functionality; the router itself continues operating. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog. TP-Link has released a firmware patch addressing this flaw.
RemediationAI
Apply the updated firmware released by TP-Link, available at https://www.tp-link.com/us/support/download/tl-wr841n/v14/#Firmware. The exact patched firmware version number is not independently confirmed from the available data - verify the specific build number against the vendor changelog on that page before applying. As an immediate workaround with no service dependency cost for most home users, disabling UPnP on the router's administration interface eliminates the attack surface entirely; note this will prevent UPnP-based automatic port forwarding used by gaming consoles, certain VoIP clients, and some smart home devices, which may require manual port mapping rules. Additionally, restricting LAN access to the router's UPnP port (typically TCP/UDP 1900 for SSDP discovery and dynamic HTTP ports for SOAP control) to trusted hosts reduces exposure without fully disabling the service. Refer to https://www.tp-link.com/us/support/faq/5270/ for vendor-specific security hardening guidance.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The TL-WR841N v14 is a consumer-grade 300 Mbps wireless router from TP-Link, identified by CPE cpe:2.3:a:tp-link_system_inc.:tl-wr841n_v14:*:*:*:*:*:*:*:*. Its UPnP implementation uses SOAP (Simple Object Access Protocol) over HTTP to process device control actions from LAN clients. CWE-476 (NULL Pointer Dereference) indicates that the UPnP daemon's XML parser or action dispatcher fails to validate or safely handle unexpected XML structures within SOAP action bodies - a pointer derived from parsing the malformed input is used without a null check, triggering a process crash. This class of defect is common in lightweight embedded UPnP stacks where input validation is minimal and heap or stack allocations are assumed to always succeed.
Know when Tl Wr841n V14 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Adjacent vector reflects LAN-only reachability of UPnP service; no auth needed; availability impact is low as only the UPnP daemon crashes, not the full device.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
DescriptionCVE.org
A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP action requests. A specially crafted SOAP action request containing unexpected XML content may cause the UPnP daemon to terminate unexpectedly.
Successful exploitation may result in a denial-of-service condition affecting UPnP functionality until the service is restarted or the device is rebooted.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Tl Wr841n V14
View allAuthenticated attackers can achieve root-level command execution on TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v
Authenticated OS command injection in the TP-Link TL-WR841N v14 web management interface lets an administrator-level act
An out-of-bounds read vulnerability in the UPnP service of TP-Link TL-WR841N v14 routers enables adjacent network attack
Memory corruption in the TP-Link TL-WR841N v14 embedded HTTP service allows an unauthenticated attacker with adjacent ne
NULL pointer dereference in TP-Link TL-WR841N v14's UPnP service allows adjacent-network attackers to crash the UPnP pro
Exploit-DB