CVE-2025-15606: Denial of Service (DoS) in HTTPD Input Handling on TP-Link TD-W8961N

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-23 · updated 2026-06-17
Weakness: CWE-20

Description

A Denial-of-Service (DoS) vulnerability in the httpd component of TP-Link's TD-W8961N v4.0 due to improper input sanitization, allows crafted requests to trigger a processing error that causes the httpd service to crash. Successful exploitation may allow the attacker to cause service interruption, resulting in a DoS condition.

Affected products

TP-Link Systems Inc. TD-W8961N v4.0: before 250925 — fixed in 250925

How to fix

Upgrade to a fixed version: TP-Link Systems Inc. TD-W8961N v4.0 250925. Check the vendor advisory for mitigations.

References

https://www.tp-link.com/en/support/download/td-w8961n/v4/#Firmware
https://www.tp-link.com/us/support/faq/5028/

Get alerted when CVE-2025-15606 or the next vulnerability affects your stack