CVE-2025-14739: Uninitialized Pointer Vulnerability in TP-Link WR940N and WR941ND

Severity: medium (CVSS 6.8 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-18 · updated 2026-06-17
Weakness: CWE-824

Description

Access of Uninitialized Pointer vulnerability in TP-Link WR940N and WR941ND allows local unauthenticated attackers the ability to execute DoS attack and potentially arbitrary code execution under the context of the ‘root’ user.This issue affects WR940N and WR941ND: ≤ WR940N v5 3.20.1 Build 200316, ≤ WR941ND v6 3.16.9 Build 151203.

Affected products

TP-Link Systems Inc. WR940N and WR941ND: through WR940N v5 3.20.1 Build 200316; through WR941ND v6 3.16.9 Build 151203

References

https://blog.exodusintel.com/2022/06/23/tp-link-wr940n-wr941nd-uninitialized-pointer-vulnerability/
https://www.tp-link.com/us/support/download/tl-wr940n/v5/#Firmware
https://www.tp-link.com/us/support/download/tl-wr941nd/#Firmware
https://www.tp-link.com/us/support/faq/4848/

Get alerted when CVE-2025-14739 or the next vulnerability affects your stack