CVE-2025-25901
Published: 13 February 2025
Summary
CVE-2025-25901 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Tp-Link Tl-Wr841Nd Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Information input validation directly prevents buffer overflows by checking the validity of crafted dnsserver1 and dnsserver2 parameters before processing.
Flaw remediation ensures timely patching or mitigation of the specific buffer overflow vulnerability in the router's web endpoint.
Denial-of-service protection implements mechanisms to restrict crafted packets and maintain router availability during exploitation attempts.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public web management endpoint directly enables remote unauthenticated exploitation (T1190) resulting in application/system DoS via crafted input (T1499.004).
NVD Description
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11, triggered by the dnsserver1 and dnsserver2 parameters at /userRpm/WanSlaacCfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Deeper analysisAI
CVE-2025-25901 is a buffer overflow vulnerability (CWE-787) affecting the TP-Link TL-WR841ND V11 router. The issue is triggered by crafted input to the dnsserver1 and dnsserver2 parameters in requests to the /userRpm/WanSlaacCfgRpm.htm endpoint. Published on 2025-02-13, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high-impact availability disruption with no confidentiality or integrity effects.
Unauthenticated attackers with network access to the device can exploit this vulnerability by sending a specially crafted packet targeting the vulnerable parameters. Successful exploitation leads to a Denial of Service (DoS) condition, potentially causing the router to crash or reboot and interrupting network services.
Further technical details, including exploit reproduction, are documented in the referenced advisory PDF at https://github.com/2664521593/mycve/blob/main/TP-Link/BOF_in_TP-Link_TL-WR841ND-V11_5.pdf. No vendor-specific patches or mitigations are detailed in the provided information.
Details
- CWE(s)