TP-Link TL-WR841N CVE-2026-9105

Two concrete prerequisites must both be satisfied: (1) the attacker must possess valid administrative credentials for the TL-WR841N v14 web management interface (confirmed by CVSS 4.0 PR:H - high-privilege authentication required), and (2) the attacker must be located on the same adjacent network segment as the router's management interface (confirmed by CVSS 4.0 AV:A - direct internet exploitation is not possible). The vulnerability is specific to the web management interface; if that interface is disabled or isolated to a dedicated management VLAN inaccessible to general users, exploitation is prevented. The impact ceiling is denial-of-service via crash-and-reboot - no code execution vector has been confirmed, and there is no confidentiality or integrity exposure (VC:N/VI:N in the CVSS 4.0 vector). Exploitation is further scoped to v14 hardware revision firmware.

Real-world risk is moderate-to-low despite the stack overflow primitive. The CVSS 4.0 score of 6.8 (Medium) reflects two hard constraints visible in the vector: adjacent-network attack vector (AV:A) prevents exploitation from the internet, and high-privilege requirement (PR:H) means the attacker must already hold valid administrative credentials. Impact metrics confirm VA:H with VC:N/VI:N/SC:N/SI:N/SA:N - the only consequence is temporary device unavailability via crash-and-reboot; there is no path to code execution or data exfiltration confirmed by this CVE. No EPSS score was provided, so probabilistic exploitation frequency cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no proof-of-concept code has been identified, both of which further reduce urgency. The scenario where a threat actor already possesses router admin credentials and local network access has limited incremental value over other available attack paths. The CPE/model discrepancy (TL-WR841N vs. TL-WR841M) introduces minor uncertainty about exact affected scope.

An attacker who has already obtained administrative credentials for the TL-WR841N v14 - through credential stuffing against default passwords, phishing, or lateral movement from another compromised local-network device - authenticates to the web management interface and sends an HTTP request containing a specially crafted oversized parameter. The embedded web server writes the payload into a fixed-size stack buffer without bounds checking, overflowing into adjacent stack frames and triggering a process crash. The router reboots automatically, severing all network connectivity for users on that segment for the duration of the reboot cycle.