CVE-2026-12935 Overview
CVE-2026-12935 is a stack-based buffer overflow [CWE-121] in the TP-Link TL-WR940N v6 router. The flaw resides in the Real Time Streaming Protocol (RTSP) connection tracking kernel module. The vulnerability triggers when a LAN client initiates a connection to an attacker-controlled RTSP server that responds with a specially crafted message. Improper memory handling inside the kernel module leads to corruption of the stack. Successful exploitation can produce a denial-of-service (DoS) condition or achieve remote code execution (RCE), potentially resulting in full compromise of the router. An unauthenticated attacker can exploit the device under its default configuration.
Critical Impact
Unauthenticated attackers can achieve remote code execution on TL-WR940N v6 routers, gaining kernel-level control of the device and pivoting into the LAN.
Affected Products
- TP-Link TL-WR940N hardware revision v6
- Firmware versions distributed via the TP-Link support portal prior to the vendor fix
- Deployments using the default RTSP connection tracking configuration
Discovery Timeline
- 2026-07-29 - CVE-2026-12935 published to the National Vulnerability Database (NVD)
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-12935
Vulnerability Analysis
The vulnerability lives inside the router's RTSP connection tracking (conntrack) kernel module. RTSP helpers parse control messages to open dynamic pinholes for associated media streams. The parser copies fields from an attacker-supplied RTSP response into a fixed-size stack buffer without validating length. Because the code executes in kernel context, memory corruption directly affects kernel state. This condition maps to [CWE-121] Stack-Based Buffer Overflow. The attacker does not need credentials or prior LAN presence; a single click by a LAN user on a malicious link, or an embedded RTSP resource on a visited page, is sufficient user interaction to reach the vulnerable code path.
Root Cause
The RTSP helper trusts length and content values supplied by the remote server. Fields extracted from the RTSP message are written into a stack buffer using an unbounded copy operation. No sanity checks confirm that the source length fits the destination, and no stack canaries or bounds enforcement stop the overflow before it overwrites saved return addresses and adjacent kernel structures.
Attack Vector
An attacker hosts a malicious RTSP server on the internet. A user on the LAN behind the TL-WR940N v6 opens a link or embedded object that initiates an RTSP session to that server. The connection tracking module inspects the outbound and inbound RTSP traffic to manage NAT pinholes. The crafted server response contains an oversized field that overflows the parser's stack buffer inside the kernel, allowing the attacker to hijack execution or crash the device. Because the router itself parses the traffic, no code runs on the client to gain footing on the router.
No verified public exploit code is available. Technical detail on the parsing flow and vulnerable structures should be tracked through the TP-Link FAQ Support advisory pages.
Detection Methods for CVE-2026-12935
Indicators of Compromise
- Unexpected reboots, kernel panics, or watchdog resets on TL-WR940N v6 devices coinciding with outbound RTSP sessions.
- Outbound TCP connections from LAN hosts to unfamiliar RTSP endpoints on port 554 or non-standard RTSP ports.
- RTSP responses containing unusually long header values, malformed Transport: fields, or oversized session identifiers.
- Loss of management access or configuration drift on the router after LAN users browse untrusted media content.
Detection Strategies
- Inspect network traffic at the perimeter for RTSP sessions originating from LAN clients toward untrusted destinations, and alert on abnormal RTSP header sizes.
- Correlate router availability loss with client-side browsing telemetry to identify triggering URLs.
- Baseline firmware versions across the fleet and flag TL-WR940N v6 units running pre-patch builds.
Monitoring Recommendations
- Forward router syslog and SNMP traps to a centralized log store and alert on repeated crashes of the nf_conntrack_rtsp helper.
- Monitor DNS and NetFlow for LAN clients resolving or connecting to RTSP hosts outside a sanctioned allowlist.
- Track firmware version inventory continuously so unpatched TL-WR940N v6 devices are visible after every network scan.
How to Mitigate CVE-2026-12935
Immediate Actions Required
- Apply the latest TL-WR940N v6 firmware from the TP-Link Firmware Download page as soon as it is available for your region.
- Restrict outbound RTSP (typically TCP/554) at an upstream firewall to a curated list of trusted media services.
- Isolate the router's management interface from LAN clients and enforce strong administrator credentials.
- Instruct users to avoid clicking untrusted media links until the device is patched.
Patch Information
TP-Link distributes updated firmware for the TL-WR940N v6 through its regional support portals. Consult the TP-Link Firmware Download (US), TP-Link Firmware Download (EN), and TP-Link Firmware Download (JP) pages, and follow the update guidance in the TP-Link FAQ Support article. Validate firmware integrity against vendor-published hashes before flashing, and reboot the device to activate the fix.
Workarounds
- Disable the RTSP application-layer gateway or connection tracking helper on the router if the option is exposed in the administrative interface.
- Block outbound RTSP protocol traffic at an upstream firewall to prevent LAN clients from reaching malicious RTSP servers.
- Replace end-of-life TL-WR940N v6 hardware with a currently supported router where feasible.
# Example upstream firewall rule to block outbound RTSP until patching is complete
iptables -I FORWARD -p tcp --dport 554 -j DROP
iptables -I FORWARD -p udp --dport 554 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
