CVE-2025-9014

High

Description

A Null Pointer Dereference vulnerability exists in the referer header check of the web portal of TP-Link TL-WR841N v14, caused by improper input validation. A remote, unauthenticated attacker can exploit this flaw and cause Denial of Service on the web portal service.This issue affects TL-WR841N v14: before 250908.

SeverityHigh

CVSS7.5

Exploit probability—

Product

Tp-link Tl-wr841n Firmware

PublishedJan 15, 2026

First seenJan 15, 2026

Weakness typeCWE-20Improper input validation

How to fix

Update

tp-link tl-wr841n_firmware250908 or later

Patches

tp-link.com/jp/support/download/tl-wr841n/#Firmware
tp-link.com/en/support/download/tl-wr841n/#Firmware
tp-link.com/us/support/download/tl-wr841n/#Firmware

Vendor advisories

tp-link.com/us/support/faq/4894/

Affected products

Product	Affected versions	Fixed in
tp-link tl-wr841n_firmware	v < 250908	250908

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.