Critical TP-Link Router Flaw Enables Remote Code Execution

TP-Link has released a security advisory for a high-severity vulnerability affecting the TL-WR940N v6 wireless router. The flaw, tracked as CVE-2026-12935, could allow attackers to execute malicious code on vulnerable devices, potentially giving them full control of the router.

The vulnerability has been assigned a CVSS v4.0 score of 8.7, highlighting the importance of applying the latest firmware updates as soon as possible.

Buffer Overflow Vulnerability Identified

The issue is caused by a stack-based buffer overflow in the router’s Real-Time Streaming Protocol (RTSP) connection-tracking component.

The vulnerability can be triggered when a device connected to the local network communicates with a malicious RTSP server. If the server responds with specially crafted data, it can cause improper memory handling inside the router, leading to a system crash or remote code execution.

Unlike many router vulnerabilities, this flaw does not require attackers to authenticate with the device under its default configuration.

However, exploitation requires some user interaction. A user must first access a malicious RTSP stream, such as opening a harmful media link or connecting to an attacker-controlled streaming service.

Potential Security Risks

If successfully exploited, attackers could:

Execute malicious code on the router.
Modify network or security settings.
Monitor or intercept network traffic.
Install persistent malware.
Use the compromised router to launch attacks against other devices on the network.

Because routers act as the gateway between users and the internet, compromising one can expose every connected device to additional risks.

Affected Versions and Fixes

The vulnerability only impacts TP-Link TL-WR940N hardware version v6.

TP-Link has released firmware updates that address the issue for regional versions, including:

(EN)_V6_260528
(US)_V6_260528
(JP)_V6_260527

Users should download and install the appropriate firmware from TP-Link’s official support website as soon as possible.

Recommended Security Measures

Until systems are updated, users and organizations should:

Install the latest TP-Link firmware.
Avoid connecting to untrusted RTSP streaming services.
Secure the router’s administration interface with a strong, unique password.
Monitor network activity for unusual behavior.
Regularly review router firmware for new security updates.

Conclusion

The discovery of CVE-2026-12935 highlights the importance of keeping networking devices up to date. Since routers are a critical part of any home or enterprise network, timely firmware updates and good security practices remain essential to protecting against remote attacks and maintaining a secure network environment.