EUVD-2026-40136
GHSA-whjh-xgqc-hvvf
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent network vector and high-privilege requirement reflect mandatory local-network admin access; scope unchanged and impact confined to availability only.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
Lifecycle Timeline
1DescriptionCVE.org
An authenticated stack-based buffer overflow vulnerability exists in the web management interface of TP-Link TL-WR841N v14. A remote authenticated attacker can send crafted HTTP requests to cause the embedded web server to overflow a stack buffer, resulting in a crash of the affected process.
Successful exploitation results in a denial-of-service condition, causing the device to crash and automatically reboot.
AnalysisAI
Stack-based buffer overflow in the TP-Link TL-WR841N v14 web management interface allows an authenticated attacker on the same local network segment to crash the embedded web server via crafted HTTP requests, forcing the device to automatically reboot. The impact is limited exclusively to availability - no confidentiality or integrity exposure has been identified. No public exploit code or CISA KEV listing exists at time of analysis; the constrained attack prerequisites (adjacent network, administrative credentials) significantly bound real-world risk.
Technical ContextAI
The root cause is CWE-121 (Stack-based Buffer Overflow): the embedded HTTP server in the router's management interface copies user-supplied request data into a fixed-size stack buffer without validating the input length, allowing an attacker to overwrite adjacent stack memory. The affected hardware is TP-Link TL-WR841N v14, a consumer-grade 300 Mbps wireless N router. The CPE identifier in the intelligence data - cpe:2.3:a:tp-link_systems_inc.:tl-wr841m_v14 - references the TL-WR841M variant rather than the TL-WR841N named in the CVE description; this model-letter discrepancy (N vs. M) may indicate the advisory covers both product lines, or may reflect a data entry error in the CPE string. The CVSS 4.0 vector confirms the attack surface is the adjacent local network (AV:A), limiting reachability to devices on the same network segment as the router's management interface.
RemediationAI
The primary remediation is to upgrade the TL-WR841N v14 firmware to the patched version published by TP-Link, available at https://www.tp-link.com/en/support/download/tl-wr841n/v14/#Firmware (international) and https://www.tp-link.com/us/support/download/tl-wr841n/v14/#Firmware (US). The exact fixed firmware version number is not specified in the available intelligence - confirm the target version against the vendor advisory at https://www.tp-link.com/us/support/faq/5152/ before deploying to avoid applying an outdated image. As a compensating control prior to patching, restrict management interface access to trusted wired LAN interfaces only and disable wireless-to-management routing if the platform supports it, reducing the pool of potential attackers. Rotate or strengthen the administrative password to prevent unauthorized parties from meeting the PR:H prerequisite; this does not eliminate the vulnerability but raises the barrier for exploitation. Disabling the web management interface entirely removes the attack surface but also eliminates remote management capability until re-enabled.
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today