CVE-2025-9377

HIGH(7.2)KEVElevated Risk

TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability

Description

The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9. This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108. Both products have reached the status of EOL (end-of-life). It's recommending to purchase the new product to ensure better performance and security. If replacement is not an option in the short term, please use the second reference link to download and install the patch(es).

KEV Information

Vendor
TP-Link
Product
Multiple Routers
Date Added
September 3, 2025
Due Date
September 24, 2025
Required Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVSS Score

Vector String
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.2
Impact Score
5.9

CWEs

CWE-78OS Command Injection

Improper Neutralization of Special Elements used in an OS Command

Affected Products

VendorProductVersion
tp-linktl-wr841n firmware< 241108
tp-linktl-wr841nd firmware< 241108
tp-linkarcher c7 firmware< 241108

References

CVSS Score

7.2
HIGH(7.2)

EPSS Score

EPSS Score11.79%
EPSS Percentile95.7%

Dates

PublishedAugust 29, 2025
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch