CVE-2025-9014: tp-link systems inc. tl-wr841n v14 Improper Input Validation
Vulnerability summary
CVE-2025-9014 is a high (CVSS 7.5) Improper Input Validation vulnerability in tp-link systems inc. tl-wr841n v14. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.5% of scored vulnerabilities.
Timeline
- 15-01-2026PublishedVulnerability first disclosed.
- 15-01-2026Last modifiedVulnerability information updated.
Description
A Null Pointer Dereference vulnerability exists in the referer header check of the web portal of TP-Link TL-WR841N v14, caused by improper input validation. A remote, unauthenticated attacker can exploit this flaw and cause Denial of Service on the web portal service.This issue affects TL-WR841N v14: before 250908.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.51%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
+0.01 pp
From 0.50% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.
Affected systems
Tp-link1 product
- tl-wr841n_firmware< 250908
Tp-link systems inc.1 product
- tl-wr841n v14< 250908
2 vendors · 2 products