CVE-2026-76650: TL-WR841N v14 UPnP DoS Vulnerability

CVE-2026-76650 Overview

CVE-2026-76650 is a NULL pointer dereference vulnerability [CWE-476] in the TP-Link TL-WR841N v14 router. The flaw resides in the Universal Plug and Play (UPnP) service when it processes Simple Object Access Protocol (SOAP) state variable query requests. An attacker on the adjacent network can send a specially crafted SOAP query to trigger unexpected termination of the process hosting the UPnP service. Successful exploitation produces a denial-of-service condition affecting UPnP discovery, state query, and related management functionality until the process is restarted or the device is rebooted.

Critical Impact
An adjacent-network attacker can crash the UPnP service on TL-WR841N v14 devices by sending a malformed SOAP state variable query, disrupting UPnP-dependent services until reboot.

Affected Products

TP-Link TL-WR841N v14 router firmware
UPnP service handling SOAP QueryStateVariable requests
Deployments exposing UPnP on the local area network (LAN) or adjacent Wi-Fi segments

Discovery Timeline

2026-08-28 - CVE-2026-76650 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-76650

Vulnerability Analysis

The vulnerability is a NULL pointer dereference in the UPnP daemon shipped with TL-WR841N v14 firmware. UPnP relies on SOAP over HTTP for control actions, including state variable queries used to read device state. When the daemon parses a SOAP request that targets state variable queries, one or more expected fields in the parsed request object are not populated. The handler proceeds to dereference the resulting NULL pointer, causing a segmentation fault in the service process.

Because the affected process hosts UPnP discovery, control, and eventing, a single crafted request can disable UPnP-dependent functionality on the device. The router itself continues to route traffic, but UPnP-managed port mappings and state queries fail until the daemon is respawned or the device is rebooted.

Root Cause

The root cause is missing input validation in the SOAP request parser before pointer dereference. The handler assumes required elements of the SOAP body — for example, the state variable name or its associated context structure — are always present and valid. When a crafted request omits or malforms these elements, the parser returns a NULL result that downstream code uses without a null check, matching the pattern described by CWE-476: NULL Pointer Dereference.

Attack Vector

Exploitation requires network adjacency to the target — an attacker on the same LAN, guest Wi-Fi, or an adjacent broadcast segment where the UPnP service is reachable. No authentication or user interaction is required. The attacker sends an HTTP POST containing a malformed SOAP QueryStateVariable envelope to the UPnP control endpoint advertised by the device. The malformed envelope triggers the NULL dereference and terminates the UPnP process. The vulnerability does not permit code execution, information disclosure, or persistent configuration changes; the impact is limited to availability of UPnP-related functions.

Detection Methods for CVE-2026-76650

Indicators of Compromise

Repeated inbound HTTP POST requests to the UPnP control URL (commonly ports 1900, 5000, or 49152–49999) with malformed SOAP QueryStateVariable bodies
Loss of UPnP discovery responses (SSDP M-SEARCH replies) from the device shortly after a suspicious SOAP request
Failure of applications relying on UPnP port mapping to establish or renew mappings without a corresponding administrative change

Detection Strategies

Inspect LAN-side HTTP traffic for SOAP envelopes containing QueryStateVariable actions with missing or empty varName elements or malformed XML namespaces
Correlate UPnP service restarts or SSDP announcement gaps with preceding SOAP traffic from the same source host
Baseline expected UPnP clients on the network and alert on SOAP control requests from unknown or unmanaged endpoints

Monitoring Recommendations

Log inbound requests to the UPnP control endpoint on affected TL-WR841N devices where syslog forwarding is available
Monitor for router reboot events or UPnP daemon restarts that follow adjacent-network SOAP activity
Track health of applications and services that depend on UPnP port mapping as a downstream signal of service disruption

How to Mitigate CVE-2026-76650

Immediate Actions Required

Check the TP-Link TL-WR841N v14 firmware download page and apply the latest firmware that addresses this issue
Disable UPnP on the router if it is not required by applications on the network
Restrict Wi-Fi and LAN access to trusted devices to reduce exposure to adjacent-network attackers

Patch Information

Refer to the vendor firmware distribution pages for TL-WR841N v14: US region firmware and the TP-Link TL-WR841N FAQ for upgrade instructions. Verify the firmware release notes reference this NULL pointer dereference in the UPnP SOAP handler before deploying.

Workarounds

Turn off UPnP in the router administration interface and manage port forwarding manually for required services
Segment the router onto a management VLAN or SSID that excludes untrusted clients and guest devices
Isolate guest Wi-Fi from the LAN so untrusted clients cannot reach the UPnP control endpoint
Reboot the device or restart the UPnP service to restore functionality after a crash while a patch is being planned

bash

# Example: disable UPnP via the TL-WR841N web UI
# Navigate to: Advanced -> NAT Forwarding -> UPnP
# Set UPnP Service: Disabled
# Save and reboot the router