CVE-2025-9377
Published: 29 August 2025
Summary
CVE-2025-9377 is a high-severity OS Command Injection (CWE-78) vulnerability in Tp-Link Tl-Wr841N Firmware. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 4.2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely remediation of the known authenticated RCE flaw through patching the vulnerable firmware or replacing EOL devices.
Prohibits the use of unsupported EOL system components like the affected TP-Link routers, eliminating exposure to unpatchable vulnerabilities.
Enforces validation of user inputs to the Parental Control page, preventing command injection (CWE-78) exploitation even with administrative privileges.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authenticated OS command injection (CWE-78) on the web management interface of an internet-facing router directly enables remote exploitation of a public-facing application and arbitrary Unix shell command execution.
NVD Description
The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9. This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108. Both products have reached the status…
more
of EOL (end-of-life). It's recommending to purchase the new product to ensure better performance and security. If replacement is not an option in the short term, please use the second reference link to download and install the patch(es).
Deeper analysisAI
CVE-2025-9377 is an authenticated remote command execution vulnerability (CWE-78) in the Parental Control page of TP-Link Archer C7(EU) V2 firmware versions before 241108 and TL-WR841N/ND(MS) V9 firmware versions before 241108. It carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Both affected products have reached end-of-life (EOL) status.
An attacker requires high privileges, such as administrative access obtained through valid authentication, to exploit the vulnerability over the network. Exploitation involves low complexity and no user interaction, enabling remote command execution on the device with high impacts to confidentiality, integrity, and availability.
TP-Link advisories recommend replacing the EOL devices with new products to ensure better performance and security. If immediate replacement is not possible, users should download and install the available patches using the second reference link.
The vulnerability appears in the CISA Known Exploited Vulnerabilities Catalog.
Details
- CWE(s)
- KEV Date Added
- 03 September 2025