Buffer Overflow Vulnerability in TL-WR940N v6 Router from TP-Link
CVE-2026-12935
8.7HIGH
What is CVE-2026-12935?
The TL-WR940N v6 router features a vulnerability in its RTSP connection tracking module that can create a stack-based buffer overflow. This occurs when a LAN client connects to a malicious RTSP server, leading to improper memory handling within the kernel module. Attackers can exploit this weakness using specially crafted RTSP messages, potentially causing a denial-of-service condition or enabling remote code execution, which could fully compromise the device. Unauthenticated access under default settings heightens the risk associated with this vulnerability.
Affected Version(s)
TL-WR940N v6 0
TL-WR940N v6 0
TL-WR940N v6 0
References
CVSS V4
Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Ryo Shimada, University of Tsukuba; Powder Keg Technologies, Inc.