CVE-2025-9377: TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability

Vulnerability summary

CVE-2025-9377 is a high (CVSS 8.6) OS Command Injection vulnerability in TP-Link Multiple Routers. It is known to be exploited: CISA lists it, first on 03-09-2025. EPSS estimates a 37.73% chance of exploitation in the next 30 days, higher than 98.5% of scored vulnerabilities.

Timeline

1. 29-08-2025
   PublishedVulnerability first disclosed.
2. 03-09-2025
   Added to CISA KEVTP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability
3. 24-09-2025
   CISA remediation dueApply mitigations per vendor instructions.
4. 26-02-2026
   Last modifiedVulnerability information updated.

Description

The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9. This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108. Both products have reached the status of EOL (end-of-life). It's recommending to purchase the new product to ensure better performance and security. If replacement is not an option in the short term, please use the second reference link to download and install the patch(es).

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.