TL-WR841N v14 CVE-2026-76651

Adjacent network access is required - the attacker must share the same LAN segment, Wi-Fi broadcast domain, or equivalent layer-2 network as the TL-WR841N v14 router (AV:A per CVSS 4.0 vector). The embedded HTTP service must be running and reachable, which is its default operational state. No authentication is required (PR:N per CVSS 4.0 vector) and no user interaction is needed. The specific trigger condition is submission of a multipart/form-data HTTP request containing a malformed or oversized boundary parameter value. Exploitation is fundamentally limited by the adjacent network requirement: an internet-based attacker cannot directly reach the service unless the router's HTTP management port has been explicitly forwarded from the WAN interface, which is a non-default configuration. Guest wireless network users who share a broadcast domain with the router's management interface represent the most realistic unauthenticated threat actor in typical home deployments.

The CVSS 4.0 score of 5.3 appropriately reflects a constrained, moderate-risk vulnerability. The primary limiting factor is the adjacent-network attack vector (AV:A): exploitation requires the attacker to be on the same LAN or Wi-Fi broadcast domain as the router, precluding opportunistic internet-scale attacks unless the HTTP management interface is explicitly exposed to the WAN or an untrusted segment. Authentication is not required (PR:N), lowering the bar once adjacent access is achieved. The confirmed impact is restricted to low integrity modification of the vulnerable system's memory (VI:L), with no confidentiality (VC:N) or availability (VA:N) impact per the authoritative CVSS vector - a direct contradiction of the 'RCE' and 'Information Disclosure' tags, which reflect theoretical potential rather than demonstrated capability. EPSS data was not provided in the available intelligence, so probabilistic exploitation likelihood cannot be quantified. No KEV listing and no public exploit code are confirmed. In enterprise environments this is a low priority; in home and SOHO deployments where guest wireless users share a broadcast domain with the router's admin interface, the risk is practically higher, as any guest can send crafted requests without authentication.

An attacker connected to the same Wi-Fi or LAN segment as the TL-WR841N v14 router - such as a guest on the home network or a neighbor who has gained wireless access - sends a crafted HTTP POST request to the device's embedded web administration service with a multipart/form-data body containing an abnormally long boundary parameter. The router's HTTP parser copies the boundary value into a fixed-size internal buffer without checking length, overwriting adjacent memory. The immediate outcome is undefined application behavior, potentially causing the router to behave erratically; reliable code execution has not been demonstrated and no public proof-of-concept exists at time of analysis.