Quick answers
- Is CVE-2026-9105 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-9105 being exploited in the wild.
- How severe is CVE-2026-9105?
- Informational severity, with a CVSS score of 6.8, published 29 June 2026.
- Which products and versions are affected?
- TP-Link TL-WR841N v14 (prior to firmware V14_260518).
- Is there a fix for CVE-2026-9105?
- A patch was published on 2026-05-18: Based on fixed firmware version string V14_260518 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-9105 attacked?
- It is attacked from the adjacent network, in a network appliance.
- Am I affected by CVE-2026-9105?
- Check whether you run TP-Link TL-WR841N at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stack-based buffer overflow (CWE-121) exists in the embedded web server of the TP-Link TL-WR841N v14. The vulnerability is triggered when the web management interface processes specifically crafted HTTP requests. An attacker must be authenticated with high privileges (PR:H) and have network access to the device's management interface (typically via the adjacent network). Successful exploitation causes the web server process to crash, leading to a full device reboot and a denial-of-service condition. TP-Link has released firmware version V14_260518 to address this issue.
Affected products
- TP-Link TL-WR841N v14 (prior to firmware V14_260518)
Timeline
- 2026-06-29: disclosed
- 2026-06-29: advisory
- 2026-05-18: patched: Based on fixed firmware version string V14_260518