What’s Vulnerable › Vulnerabilities

CVE-2025-9014: Null Pointer Dereference Vulnerability on TL-WR841N

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-15 · updated 2026-06-17
• Weakness: CWE-20

Description

A Null Pointer Dereference vulnerability exists in the referer header check of the web portal of TP-Link TL-WR841N v14, caused by improper input validation.  A remote, unauthenticated attacker can exploit this flaw and cause Denial of Service on the web portal service.This issue affects TL-WR841N v14: before 250908.

Affected products

• TP-Link TL-WR841N: before 250908 — fixed in 250908

How to fix

Upgrade to a fixed version: TP-Link TL-WR841N 250908. Check the vendor advisory for mitigations.

References

• https://www.tp-link.com/en/support/download/tl-wr841n/#Firmware
• https://www.tp-link.com/jp/support/download/tl-wr841n/#Firmware
• https://www.tp-link.com/us/support/download/tl-wr841n/#Firmware
• https://www.tp-link.com/us/support/faq/4894/

Get alerted when CVE-2025-9014 or the next vulnerability affects your stack