TP-Link TL-WR940N Router Vulnerable to Remote Code Execution
A critical stack-based buffer overflow vulnerability in TP-Link TL-WR940N V6 routers allows unauthenticated attackers to achieve remote code execution or denial-of-service.
TP-Link has issued a security advisory for a high-severity vulnerability, designated CVE-2026-12935, affecting its TL-WR940N V6 wireless router. This flaw could permit unauthenticated attackers to initiate a denial-of-service (DoS) condition or achieve remote code execution (RCE) on vulnerable devices under specific exploitation scenarios.
The vulnerability resides within the router's Real-Time Streaming Protocol (RTSP) connection tracking (conntrack) module. RTSP is typically used for controlling multimedia streaming sessions. The affected module processes RTSP-related network traffic within the router's kernel, the core component of its operating system. The issue stems from a stack-based buffer overflow, which occurs when specially crafted data exceeds the allocated memory buffer, leading to memory corruption.
Exploitation requires an attacker to run a malicious RTSP server and trick a device on the local network into connecting to it. Once a LAN client establishes a connection with the attacker-controlled RTSP server, the server can respond with a malicious RTSP message. The vulnerable conntrack module may then mishandle this data, resulting in memory corruption within the router's kernel. This can lead to a device crash (DoS) or, more critically, enable the execution of arbitrary code controlled by the attacker.
Successful remote code execution would grant attackers significant control, potentially allowing them to alter network configurations, intercept sensitive traffic, redirect DNS requests, deploy persistent malware, or leverage the compromised router to attack other devices within the local network. The vulnerability has been assigned a CVSS v4.0 score of 8.7, categorized as High. While the attack vector is network-based and has low complexity, requiring no authentication, it does necessitate user interaction as a LAN client must initiate the connection to the malicious server.
TP-Link has confirmed that this vulnerability specifically impacts the TL-WR940N hardware version V6. To address the issue, the company has released firmware updates for affected regional versions. These include firmware version (EN)_V6_260528 for English devices, (US)_V6_260528 for US devices, and (JP)_V6_260527 for Japanese devices. Users are strongly advised to verify their router's exact hardware version and regional firmware edition before applying updates, as installing incorrect firmware could cause operational problems or device malfunction.
Users should only download firmware updates from TP-Link's official support portal. Until devices can be updated, organizations and home users are recommended to restrict unnecessary outbound RTSP connections from devices on their local networks. Network administrators should also consider monitoring for unusual RTSP traffic, unexpected router reboots, or unauthorized configuration changes that might indicate exploitation attempts.
TP-Link credited Ryo Shimada of Powder Keg Technologies, Inc. for the responsible disclosure of this vulnerability. Prompt installation of the provided firmware updates is the most effective mitigation strategy against CVE-2026-12935.