# CVE-2026-76649: TP-Link TL-WR841N NULL pointer dereference in UPnP service

Source: https://junglewise.ai/threats/cve-2026-76649-tp-link-tl-wr841n-null-pointer-dereference-in-upnp-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76649 · Severity: info · Published 2026-08-28

The TP-Link TL-WR841N wireless router contains a NULL pointer dereference vulnerability in its UPnP service, which allows network devices to discover and control other devices on the network. A specially crafted network request can cause the UPnP service to crash unexpectedly, temporarily disabling UPnP functionality until the service or device is manually restarted. This could disrupt home or office automation scenarios that rely on UPnP-enabled device discovery.

Technologies: [TP-Link TL-WR841N](https://junglewise.ai/threats/technologies/tl-wr841n). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-76649 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76649 being exploited in the wild.

**How severe is CVE-2026-76649?** Informational severity, published 28 August 2026.

**Which products and versions are affected?** TP-Link TL-WR841N v14.

**Is there a fix for CVE-2026-76649?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76649 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-76649?** Check whether you run TP-Link TL-WR841N at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NULL pointer dereference vulnerability exists in the UPnP daemon on TP-Link TL-WR841N v14 when processing SOAP (Simple Object Access Protocol) action requests. An unauthenticated remote attacker on the network can send a specially crafted SOAP request with malformed XML content to trigger the vulnerability, causing the UPnP daemon process to dereference a NULL pointer and terminate abnormally. The attack requires network access to the router but no authentication. Successful exploitation results in denial-of-service (DoS) affecting UPnP functionality until the service is restarted or the device is rebooted. No patch information is currently available.

## Affected products

- TP-Link TL-WR841N v14

## Timeline

- 2026-08-28: disclosed

## References

- [https://www.tp-link.com/en/support/download/tl-wr841n/v14/](https://www.tp-link.com/en/support/download/tl-wr841n/v14/)
- [https://www.tp-link.com/us/support/download/tl-wr841n/v14/](https://www.tp-link.com/us/support/download/tl-wr841n/v14/)

## Related threats

- [TP-Link TL-WR841N OS command injection in IPv6 WAN configuration](https://junglewise.ai/threats/cve-2026-102294-tp-link-tl-wr841n-contains-an-authenticated-os-command-injection)
- [TP-Link TL-WR841N buffer overflow in HTTP service](https://junglewise.ai/threats/cve-2026-76651-tp-link-tl-wr841n-buffer-overflow-in-http-service)
- [TP-Link TL-WR841N v14 NULL pointer dereference in UPnP](https://junglewise.ai/threats/cve-2026-76650-tp-link-tl-wr841n-v14-null-pointer-dereference-in-upnp)
- [TP-Link TL-WR841N stack overflow in web management interface](https://junglewise.ai/threats/cve-2026-9105-tp-link-tl-wr841n-stack-overflow-in-web-management-interface)
- [TP-Link TL-WR841N v13 uses DES-CBC encryption in the TDDPv2 debug protocol with a cryptographic key derived from…](https://junglewise.ai/threats/cve-2026-5039-tp-link-tl-wr841n-v13-uses-des-cbc-encryption-in-the-tddpv2-debug)