Null Pointer Dereference Vulnerability in TP-Link TL-WR841N Router
CVE-2025-9014

6.3MEDIUM

Key Information:

Vendor

Tp-link Systems Inc.

Status
Tl-wr841n V14
Vendor
CVE Published:
15 January 2026

What is CVE-2025-9014?

A vulnerability exists in the web portal of the TP-Link TL-WR841N v14 router, specifically within the referer header check, which is attributed to improper input validation. This flaw allows a remote, unauthenticated attacker to exploit the vulnerability, potentially leading to a Denial of Service condition for the web portal service. Users are advised to apply necessary patches to protect their devices.

Affected Version(s)

TL-WR841N v14 0 < 250908

References

https://www.tp-link.com/us/support/faq/4894/
vendor-advisory
https://www.tp-link.com/jp/support/download/tl-wr841n/#Fi...
patch
https://www.tp-link.com/en/support/download/tl-wr841n/#Fi...
patch

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Justus W. Perlwitz, JWP Consulting
.