TL-WR841N CVE-2026-76650

Exploitation requires the attacker to be on an adjacent network - the same LAN segment, local Wi-Fi broadcast domain, or otherwise directly layer-2 adjacent to the device (CVSS AV:A). The UPnP service must be enabled; UPnP is enabled by default on the TL-WR841N and most consumer routers, making this a common configuration. No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N). Remote exploitation from the internet is not possible unless the router is additionally and non-standardly misconfigured to expose UPnP externally. Exploitation is further limited in scope: only the UPnP service process is disrupted; core IP routing, WAN connectivity, and the administrative interface remain operational. The crash is not persistent - a reboot or process restart restores normal UPnP function.

The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) scores 5.3, reflecting an adjacent-network attack requiring no privileges and producing only low availability impact confined to the vulnerable system. The adjacent attack vector (AV:A) is the primary limiting factor: exploitation requires the attacker to already occupy the same LAN segment or Wi-Fi broadcast domain, substantially reducing the realistic attacker pool to local users, compromised LAN devices, or malicious insiders. The impact is further bounded to the UPnP daemon alone - no confidentiality or integrity impact is present, and the router's core routing and WAN functions continue unaffected when the UPnP process crashes. No EPSS score, KEV listing, or public proof-of-concept code was included in the provided data, so the real-world exploitation probability cannot be quantified; active exploitation is neither confirmed nor ruled out. Overall this represents a low-priority patching item for enterprise environments, though home users who depend on UPnP-enabled devices should apply available firmware updates as a routine matter.

An attacker already present on the same local network - for example a guest Wi-Fi user, a compromised LAN host, or a malicious insider - sends a specially crafted SOAP state variable query to the TL-WR841N v14's UPnP service control URL. The malformed request triggers a NULL pointer dereference inside the UPnP daemon, causing the process to terminate unexpectedly. UPnP-dependent services such as automatic port forwarding and device discovery become unavailable until the router is rebooted. No public proof-of-concept code has been identified at time of analysis.