CVE-2025-6151
Published: 17 June 2025
Summary
CVE-2025-6151 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Tp-Link Tl-Wr940N Firmware. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A buffer overflow vulnerability exists in the TP-Link TL-WR940N V4 and TL-WR841N V11 routers, specifically within an unknown function of the file /userRpm/WanSlaacCfgRpm.htm. The flaw is tracked under CWE-119 and CWE-120 and carries a CVSS 4.0 score of 8.2, reflecting network attack vector, low attack complexity, and high availability impact on both the vulnerable component and the broader system. The affected devices are end-of-life products that are no longer supported by TP-Link.
An attacker with administrative credentials can send a crafted request to the web management interface from a remote network position, triggering the overflow. Successful exploitation can crash the device or produce secondary availability effects without requiring user interaction, though confidentiality and integrity impacts are not indicated by the CVSS vector.
TP-Link’s support documentation states that the TL-WR940N V4 and TL-WR841N V11 are no longer maintained, and the vendor provides no patches or firmware updates for these models. Public references, including VulDB entries and an associated GitHub report, likewise note the lack of vendor remediation.
The EPSS score remains flat at 0.0161 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-18451
Vulnerability details
A vulnerability has been found in TP-Link TL-WR940N V4 and TL-WR841N V11. Affected by this issue is some unknown functionality of the file /userRpm/WanSlaacCfgRpm.htm, which may lead to buffer overflow. The attack may be launched remotely. This vulnerability only affects…
more
products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in the router's unauthenticated web interface (/userRpm/WanSlaacCfgRpm.htm) enables exploitation of a public-facing application (T1190) to cause denial of service via application or system exploitation (T1499.004), as demonstrated by the PoC crashing the device.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Managed runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation.
Ongoing control assessments and code testing (static/dynamic analysis, fuzzing) surface memory buffer restriction failures, which are then remediated before release.
Memory protections (e.g., W^X, ASLR) make exploitation of buffer-boundary violations far harder to turn into code execution.
Detects exploitation attempts that produce memory corruption, crashes, or anomalous behavior.