Tp Link System Inc
Monthly
Memory corruption in the TP-Link TL-WR841N v14 embedded HTTP service allows an unauthenticated attacker with adjacent network access to trigger a buffer overflow by submitting a crafted multipart/form-data request containing an oversized boundary parameter. The confirmed impact is limited to undefined application behavior resulting from process memory corruption; TP-Link's own advisory and the CVE description both explicitly state that arbitrary code execution, information disclosure, and denial-of-service have not been demonstrated, despite those labels appearing in the CVE tags. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.
NULL pointer dereference in TP-Link TL-WR841N v14's UPnP service allows adjacent-network attackers to crash the UPnP process by sending a specially crafted SOAP state variable query, resulting in a denial-of-service condition. The affected UPnP functionality - including device discovery and state management - remains unavailable until the process is restarted or the device is rebooted. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
NULL pointer dereference in the UPnP SOAP request handler of the TP-Link TL-WR841N v14 allows an adjacent-network attacker to crash the UPnP daemon by sending a crafted SOAP action request with unexpected XML content, producing a denial-of-service condition until the service is restarted or the device rebooted. Impact is confined to UPnP functionality; the router itself continues operating. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog. TP-Link has released a firmware patch addressing this flaw.
Memory corruption in the TP-Link TL-WR841N v14 embedded HTTP service allows an unauthenticated attacker with adjacent network access to trigger a buffer overflow by submitting a crafted multipart/form-data request containing an oversized boundary parameter. The confirmed impact is limited to undefined application behavior resulting from process memory corruption; TP-Link's own advisory and the CVE description both explicitly state that arbitrary code execution, information disclosure, and denial-of-service have not been demonstrated, despite those labels appearing in the CVE tags. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.
NULL pointer dereference in TP-Link TL-WR841N v14's UPnP service allows adjacent-network attackers to crash the UPnP process by sending a specially crafted SOAP state variable query, resulting in a denial-of-service condition. The affected UPnP functionality - including device discovery and state management - remains unavailable until the process is restarted or the device is rebooted. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
NULL pointer dereference in the UPnP SOAP request handler of the TP-Link TL-WR841N v14 allows an adjacent-network attacker to crash the UPnP daemon by sending a crafted SOAP action request with unexpected XML content, producing a denial-of-service condition until the service is restarted or the device rebooted. Impact is confined to UPnP functionality; the router itself continues operating. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog. TP-Link has released a firmware patch addressing this flaw.