CVE-2025-25427 Overview
CVE-2025-25427 is a stored cross-site scripting (XSS) vulnerability affecting the upnp.htm page of the TP-Link WR841N router web interface. Attackers can inject arbitrary JavaScript through the port mapping description field used by Universal Plug and Play (UPnP). The payload executes whenever an administrator loads the affected page. The flaw is classified under [CWE-79] and impacts firmware builds through Build 241230 Rel. 50788n on WR841N v14, v14.6, and v14.8. Successful exploitation can hijack administrator sessions, alter router configuration, or pivot to internal network resources.
Critical Impact
Adjacent-network attackers can execute JavaScript in the router administrator's browser context, enabling configuration tampering, credential theft, and further internal network compromise.
Affected Products
- TP-Link WR841N v14 (firmware through Build 241230 Rel. 50788n)
- TP-Link WR841N v14.6 (firmware through Build 241230 Rel. 50788n)
- TP-Link WR841N v14.8 (firmware through Build 241230 Rel. 50788n)
Discovery Timeline
- 2025-04-18 - CVE-2025-25427 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-25427
Vulnerability Analysis
The TP-Link WR841N web interface fails to sanitize user-controlled input submitted through the UPnP port mapping description field. When a UPnP-enabled device or attacker submits a port mapping request, the router stores the description string without encoding HTML or JavaScript metacharacters. The upnp.htm administrative page later renders this stored value directly into the DOM. This causes the browser to interpret injected <script> tags or event handlers as executable code.
The vulnerability requires an attacker on the adjacent network and user interaction from an administrator who loads the UPnP status page. Once triggered, the payload executes with the privileges of the administrator session, allowing arbitrary requests to router endpoints.
Root Cause
The root cause is improper neutralization of input during web page generation, mapped to [CWE-79]. The upnp.htm handler reflects the stored port mapping description without applying output encoding or a Content Security Policy. Because UPnP typically accepts requests without authentication from LAN clients, the injection sink is reachable by any host on the local network segment.
Attack Vector
An attacker positioned on the adjacent network sends a crafted UPnP AddPortMapping SOAP request containing a JavaScript payload embedded in the NewPortMappingDescription parameter. The router stores the malicious description in its UPnP mapping table. When an administrator subsequently navigates to upnp.htm in the web interface, the browser parses the injected script and executes it in the router's origin context. See the GitHub PoC Repository for a proof-of-concept demonstration.
Detection Methods for CVE-2025-25427
Indicators of Compromise
- Unexpected UPnP port mapping entries with descriptions containing HTML tags, <script> fragments, or JavaScript event handlers such as onerror= or onload=.
- Administrator browser sessions issuing unusual authenticated requests to router endpoints shortly after visiting the UPnP status page.
- Outbound requests from the administrator workstation to attacker-controlled domains referenced in stored payloads.
Detection Strategies
- Inspect UPnP mapping tables on WR841N devices for description fields containing angle brackets, quotes, or script keywords.
- Monitor LAN traffic for SOAP AddPortMapping requests where the NewPortMappingDescription element contains non-alphanumeric characters typical of XSS payloads.
- Review router configuration change events that originate from administrator sessions immediately after loading the UPnP page.
Monitoring Recommendations
- Capture and log UPnP control requests at network chokepoints to establish a baseline of legitimate port mapping activity.
- Alert on repeated UPnP mapping additions from a single LAN host within short intervals.
- Track administrative browser sessions to WR841N devices for anomalous XHR or fetch requests following navigation to upnp.htm.
How to Mitigate CVE-2025-25427
Immediate Actions Required
- Disable UPnP on affected WR841N routers until a firmware update is verified and installed.
- Restrict access to the router administrative interface to trusted management hosts only.
- Clear any existing UPnP port mapping entries and audit them for suspicious description strings.
- Advise administrators to avoid visiting upnp.htm from browsers with active sensitive sessions.
Patch Information
At the time of publication, TP-Link had not released a specific firmware fix identified in the advisory. Check the TP-Link Firmware Download page for the WR841N and consult the TP-Link FAQ Resource for update instructions. Apply firmware newer than Build 241230 Rel. 50788n once available and verify the release notes reference CVE-2025-25427.
Workarounds
- Turn off UPnP under Advanced settings and manage port forwarding manually.
- Segment the router management VLAN away from untrusted LAN and guest wireless clients.
- Use a hardened, isolated browser profile with no other authenticated sessions when administering the router.
# Configuration example - disable UPnP via the web interface
# Navigate to: Advanced > NAT Forwarding > UPnP
# Toggle UPnP to: Disabled
# Save configuration and reboot the router
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
