VulnerabilityAnalyzed

CVE-2025-9014

A Null Pointer Dereference vulnerability exists in the referer header check of the web portal of TP-Link TL-WR841N v14, caused by improper input validation.

MEDIUM 6.3EPSS 0.50%

Does this matter?

Lower severity and a low EPSS score (0.50%). Track it; it rarely justifies an emergency change on its own.

Description

A Null Pointer Dereference vulnerability exists in the referer header check of the web portal of TP-Link TL-WR841N v14, caused by improper input validation. A remote, unauthenticated attacker can exploit this flaw and cause Denial of Service on the web portal service.This issue affects TL-WR841N v14: before 250908.

CVSS 4.0: 6.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.50% probability · 41th percentile
CISA KEV: Not listed
Weakness: CWE-20, CWE-476
Affected: tp-link/tl-wr841n firmware
Source: f23511db-6c3e-4e32-a477-6aa17d310630

References

https://www.tp-link.com/en/support/download/tl-wr841n/#FirmwareProduct
https://www.tp-link.com/jp/support/download/tl-wr841n/#FirmwareProduct
https://www.tp-link.com/us/support/download/tl-wr841n/#FirmwareProduct
https://www.tp-link.com/us/support/faq/4894/Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.