CVE-2026-3622: TL-WR841N UPnP DoS Vulnerability

CVE-2026-3622 Overview

A high-severity out-of-bounds read vulnerability has been identified in the Universal Plug and Play (UPnP) component of TP-Link TL-WR841N v14 wireless routers. The vulnerability stems from improper input validation in the UPnP service, which allows an attacker on the adjacent network to trigger an out-of-bounds memory read operation. Successful exploitation results in a crash of the UPnP service, causing a Denial-of-Service (DoS) condition that disrupts network functionality.

Critical Impact

Attackers on the local network can crash the UPnP service on vulnerable TP-Link TL-WR841N v14 routers, disrupting network port forwarding and discovery services for all connected devices.

Affected Products

• TP-Link TL-WR841N v14 (EN firmware versions prior to EN_0.9.1 4.19 Build 260303 Rel.42399n (V14_260303))
• TP-Link TL-WR841N v14 (US firmware versions prior to US_0.9.1.4.19 Build 260312 Rel. 49108n (V14_0304))

Discovery Timeline

• 2026-03-26 - CVE CVE-2026-3622 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-3622

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read), a memory corruption flaw that occurs when software reads data past the end of the intended buffer. In the context of the TP-Link TL-WR841N v14 router, the UPnP service fails to properly validate input data before processing, allowing crafted requests to cause the service to read beyond allocated memory boundaries.

The adjacent network attack vector means an attacker must be connected to the same local network segment as the vulnerable router—either via Wi-Fi or through a wired connection to the router's LAN ports. While this limits remote exploitation from the internet, it presents a significant risk in shared network environments, guest networks, or scenarios where attackers have achieved initial network access.

Root Cause

The root cause of CVE-2026-3622 lies in insufficient input validation within the UPnP service's request parsing logic. The UPnP component processes incoming Simple Service Discovery Protocol (SSDP) and SOAP messages without adequately verifying the length or boundaries of user-supplied data. When malformed or oversized input is provided, the service attempts to read memory beyond the allocated buffer, triggering an out-of-bounds read condition.

This type of vulnerability typically occurs when:

• Input length checks are missing or incorrectly implemented
• Array index calculations fail to account for boundary conditions
• String parsing functions assume well-formed input without validation

Attack Vector

The attack requires adjacent network access (AV:A), meaning the attacker must be on the same network segment as the target router. The attack complexity is low, requiring no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted UPnP requests to the router's UPnP service port (typically UDP port 1900 for SSDP discovery or TCP ports for SOAP control).

The exploitation flow involves crafting malformed UPnP discovery or control messages that contain input data designed to trigger the out-of-bounds read. When the vulnerable UPnP service processes these messages, the invalid memory access causes the service to crash, interrupting UPnP functionality for all devices on the network that rely on automatic port forwarding or device discovery.

Detection Methods for CVE-2026-3622

Indicators of Compromise

• Unexpected crashes or restarts of the UPnP service on TL-WR841N v14 routers
• Failed port forwarding rules or NAT traversal failures reported by connected devices
• Unusual SSDP or UPnP traffic patterns originating from unexpected internal hosts
• Router system logs indicating UPnP service termination or memory access errors

Detection Strategies

• Monitor network traffic for anomalous SSDP (UDP 1900) packets with malformed headers or unusual payload sizes
• Implement network segmentation monitoring to detect unauthorized hosts attempting to communicate with router management interfaces
• Deploy intrusion detection signatures for known UPnP exploitation patterns targeting TP-Link devices
• Configure logging on network infrastructure to capture UPnP-related traffic anomalies

Monitoring Recommendations

• Enable verbose logging on TL-WR841N routers if supported by the firmware version
• Monitor for repeated UPnP service crashes that may indicate active exploitation attempts
• Implement network-based anomaly detection for devices exhibiting unusual broadcast behavior
• Regularly audit network logs for signs of lateral movement from compromised internal hosts

How to Mitigate CVE-2026-3622

Immediate Actions Required

• Update firmware on all TP-Link TL-WR841N v14 devices to the patched versions immediately
• Disable UPnP functionality if not required for your network environment
• Implement network segmentation to isolate IoT and infrastructure devices from untrusted network segments
• Review and restrict physical and wireless access to the affected network segment

Patch Information

TP-Link has released firmware updates that address this vulnerability. Users should update to the following versions or later:

• EN Region:EN_0.9.1 4.19 Build 260303 Rel.42399n (V14_260303) or later
• US Region:US_0.9.1.4.19 Build 260312 Rel. 49108n (V14_0304) or later

Firmware downloads are available from the TP-Link TL-WR841N Firmware Download Page. Additional guidance on firmware updates can be found in the TP-Link FAQ 5033.

Workarounds

• Disable UPnP on the router through the web administration interface (typically found under NAT Forwarding or Network Settings)
• Restrict network access to prevent untrusted devices from joining the network segment where the router operates
• Implement Wi-Fi access controls such as MAC filtering or WPA3 to limit network membership
• Consider temporarily replacing vulnerable devices with patched alternatives until firmware updates can be applied

# Example: Verifying current firmware version via router web interface
# Navigate to: http://192.168.0.1 (default gateway)
# Path: System Tools > Firmware Upgrade
# Compare displayed version against patched versions:
# EN: EN_0.9.1 4.19 Build 260303 or later
# US: US_0.9.1.4.19 Build 260312 or later