Tl Wr841n V14 EUVD-2026-16419

TP-Link TL-WR841N v14 with firmware versions < EN_0.9.1 4.19 Build 260303 or < US_0.9.1.4.19 Build 260312. Requires adjacent network access to UPnP component. No authentication or user interaction needed. Attacker sends crafted UPnP request causing out-of-bounds read and service crash.

Real-world exploitation risk is moderate. The CVSS:4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) indicates that attackers must be on the adjacent network (same local network segment as the router), which significantly limits the attack surface compared to remotely exploitable vulnerabilities. However, attack complexity is low and no privileges or user interaction are required once network adjacency is achieved. The vulnerability enables only availability impact (VA:H) with no confidentiality or integrity effects, limiting it to denial-of-service scenarios rather than data compromise or control plane attacks. No EPSS score was provided in the intelligence data, and no public exploit code has been identified, nor is there CISA KEV listing indicating active exploitation. The tags mention Information Disclosure and Buffer Overflow, though the primary manifestation is service disruption. For home and small office environments where the TL-WR841N is typically deployed, the risk is elevated if an attacker gains physical proximity or wireless access to the network, but the lack of remote exploitation capability and limited DoS-only impact reduce urgency compared to RCE or authentication bypass vulnerabilities.

An attacker who gains access to the adjacent network, either by connecting to the wireless network with valid credentials or through physical connection to a LAN port, sends specially crafted UPnP packets to the router's UPnP service. These malformed packets exploit insufficient input validation, triggering an out-of-bounds read that crashes the UPnP daemon and disrupts UPnP-dependent services such as automatic port forwarding and device discovery. While the attack requires adjacent network access, the low complexity and lack of authentication requirements mean any user on the local network could execute this attack to disrupt network functionality.