CVE-2025-6151: TP-Link TL-WR940N Buffer Overflow Flaw

CVE-2025-6151 Overview

CVE-2025-6151 is a buffer overflow vulnerability affecting TP-Link TL-WR940N V4 and TL-WR841N V11 wireless routers. The flaw resides in unknown functionality of the /userRpm/WanSlaacCfgRpm.htm file, which handles Stateless Address Autoconfiguration (SLAAC) settings for the WAN interface. Attackers can trigger the overflow remotely over the network. The affected devices are end-of-life products no longer maintained by TP-Link, meaning no official firmware patch will be released. The vulnerability maps to [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer) and [CWE-120] (Classic Buffer Overflow).

Critical Impact
Remote attackers with high privileges can corrupt router memory through the SLAAC configuration handler, leading to denial of service and potential disruption of network availability for all connected clients.

Affected Products

TP-Link TL-WR940N V4 (firmware)
TP-Link TL-WR841N V11
Both models are no longer supported by the maintainer

Discovery Timeline

2025-06-17 - CVE-2025-6151 published to the National Vulnerability Database
2025-07-15 - Last updated in NVD database

Technical Details for CVE-2025-6151

Vulnerability Analysis

The vulnerability resides in the web management interface of two legacy TP-Link consumer routers. The endpoint /userRpm/WanSlaacCfgRpm.htm processes SLAAC configuration parameters for IPv6 WAN setup. Affected processing logic fails to validate the size of input data before copying it into a fixed-size buffer. An authenticated attacker submitting crafted parameters to this endpoint can overflow the buffer and corrupt adjacent memory. The corruption produces an availability impact on the device, consistent with the CVSS vector indicating high availability impact on both the vulnerable component and subsequent systems. Because the routers reached end-of-life, no vendor patch will be issued. Owners must replace the hardware or apply compensating controls.

Root Cause

The root cause is missing bounds checking in the HTTP handler that parses SLAAC configuration fields. User-controlled data is copied into a stack or heap buffer without length validation, classified under [CWE-120]. The handler trusts client-supplied input from the administrative web UI, which is a common pattern in older embedded firmware where input sanitization is incomplete.

Attack Vector

Exploitation requires network access to the router's management interface and valid administrative credentials. Once authenticated, the attacker issues a malformed HTTP request to /userRpm/WanSlaacCfgRpm.htm with oversized field values. The overflow triggers memory corruption that can crash the HTTP service or the router itself, dropping all client connectivity. The Exploit Prediction Scoring System (EPSS) rates this CVE at approximately 1.61% probability, in the 82nd percentile of all tracked vulnerabilities. No public proof-of-concept exploit is currently listed in Exploit-DB, and CISA has not added it to the Known Exploited Vulnerabilities catalog.

No verified exploit code is publicly available. Technical details and reproduction steps are referenced in the GitHub CVE Issue Discussion and tracked in VulDB #312626.

Detection Methods for CVE-2025-6151

Indicators of Compromise

Unexpected reboots or HTTP service crashes on TL-WR940N V4 or TL-WR841N V11 routers
Inbound HTTP POST requests to /userRpm/WanSlaacCfgRpm.htm containing abnormally long parameter values
Administrative session activity from unfamiliar source IP addresses
Repeated authentication attempts against the router web UI preceding device instability

Detection Strategies

Inspect router system logs for crash signatures, watchdog resets, or repeated HTTP daemon restarts
Deploy network monitoring to flag oversized POST bodies targeting TP-Link router management URLs
Correlate WAN configuration change events with concurrent connectivity loss across LAN clients
Restrict and audit access to the router administrative interface from any non-management VLAN

Monitoring Recommendations

Forward router syslog output to a centralized logging platform for retention and correlation
Alert on any successful administrative login to legacy TP-Link devices outside change windows
Track DHCP and IPv6 router advertisement anomalies that may follow a successful overflow

How to Mitigate CVE-2025-6151

Immediate Actions Required

Replace TL-WR940N V4 and TL-WR841N V11 routers with currently supported hardware, as recommended in the TP-Link Support FAQ
Disable remote management on the WAN interface to limit the attack surface to local network users
Rotate administrative credentials and enforce strong, unique passwords on every router account
Segment legacy routers onto isolated VLANs until they can be decommissioned

Patch Information

No patch is available. TP-Link has confirmed both TL-WR940N V4 and TL-WR841N V11 are end-of-life and will not receive security updates for this issue. Organizations should treat hardware replacement as the only complete remediation. See the TP-Link Support FAQ and VulDB CTI ID #312626 for vendor status.

Workarounds

Disable IPv6 SLAAC configuration on the WAN interface if not required for the deployment
Restrict access to the router web UI using ACLs that allow only trusted management workstations
Place the router behind an upstream firewall that filters unsolicited inbound HTTP traffic
Monitor the device for stability and apply automatic reboots on failure to limit downtime

bash

# Configuration example: restrict management access from a trusted host
# Run from an upstream firewall protecting the legacy router at 192.168.1.1
iptables -A FORWARD -p tcp -d 192.168.1.1 --dport 80 -s 10.10.20.5 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.1 --dport 80 -j DROP
iptables -A FORWARD -p tcp -d 192.168.1.1 --dport 443 -s 10.10.20.5 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.1 --dport 443 -j DROP