CVE-2025-9377
TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability
Description
CVE-2025-9377 is a high-severity OS command injection vulnerability affecting TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9 routers. An authenticated attacker with administrative access can exploit the Parental Control page to execute arbitrary operating system commands on the device. With a CVSS v3.1 base score of 7.2, successful exploitation grants full control over the router, enabling traffic interception, network reconfiguration, and lateral movement within the local network. Critically, both affected TP-Link models have reached end-of-life (EOL) status, meaning long-term security patches are not guaranteed. CISA has added CVE-2025-9377 to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 24, 2025, and its EPSS score of 15.6% at the 94th percentile signals a significant probability of exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| tp-link | tl-wr841n firmware | < 241108 |
| tp-link | tl-wr841nd firmware | < 241108 |
| tp-link | archer c7 firmware | < 241108 |
References
- https://www.tp-link.com/us/support/faq/4308/(Product)
- https://www.tp-link.com/us/support/faq/4365/(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9377(US Government Resource)
Weakness Type
CWE-78: OS Command Injection
CVE-2025-9377 is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS command injection. This weakness occurs when software constructs operating system commands using user-supplied input without properly neutralizing shell metacharacters that could alter the intended command structure. In the TP-Link Archer C7 and TL-WR841N/ND routers, the Parental Control page incorporates request parameters into system-level commands without adequate sanitization, allowing an authenticated administrator to inject and execute arbitrary commands on the underlying operating system.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
The impact of CVE-2025-9377 is severe across all three dimensions of the CIA triad. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), though it requires high-level privileges (PR:H), meaning the attacker must have administrative credentials to the router's web interface. No user interaction (UI:N) is necessary beyond submitting a crafted request. Confidentiality (High): An attacker who gains command execution on the router can intercept all network traffic passing through the device, capturing credentials, session tokens, and sensitive data transmitted by all connected clients. Integrity (High): The attacker can modify DNS settings, routing tables, firewall rules, and firmware configurations, enabling man-in-the-middle attacks and traffic redirection to malicious servers. Availability (High): Complete denial of service is possible by disrupting the router's operation, bricking the firmware, or using the compromised device as a launching point for further attacks. The end-of-life status of both affected products significantly elevates the risk, as organizations relying on these routers may not receive future security updates.
Exploit Maturity
CVE-2025-9377 is confirmed to be actively exploited in the wild, as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of September 24, 2025. The EPSS score of 15.6% at the 94th percentile places it in the top 6% of vulnerabilities by exploitation probability, indicating significant real-world exploitation activity. TP-Link has acknowledged the vulnerability and provided patches through their support advisory, but both the Archer C7(EU) V2 and TL-WR841N/ND(MS) V9 have reached end-of-life status, making long-term support uncertain. Consumer-grade routers are frequently targeted by botnets and threat actors seeking to build distributed attack infrastructure, and OS command injection in router firmware represents a particularly attractive attack surface due to the typically elevated execution privileges on embedded systems.
Remediation
-
Apply the vendor-provided patches immediately. TP-Link has released firmware updates (build 241108 or later) for both the Archer C7(EU) V2 and TL-WR841N/ND(MS) V9. Download the patches from the TP-Link support page and apply them as soon as possible.
-
Plan hardware replacement. Both affected products have reached end-of-life status. TP-Link recommends purchasing newer models to ensure ongoing security support. Prioritize replacement of these devices in environments handling sensitive traffic.
-
Restrict administrative access. Change the default administrator credentials to strong, unique passwords. Disable remote management if it is enabled, limiting web interface access to the local network only. Consider implementing MAC address filtering for management access.
-
Implement network segmentation. Place the affected routers behind a firewall or network segment that limits exposure. Monitor traffic from these devices for unusual outbound connections, DNS query anomalies, or unexpected configuration changes.
-
Audit for signs of compromise. Review router configurations for unauthorized changes to DNS settings, firewall rules, or administrative accounts. Check for unknown firmware modifications or persistent backdoors. If compromise is suspected, factory-reset the device and apply the latest firmware before reconnecting it to the network.
Technical Details
CVE-2025-9377 is an authenticated remote command execution vulnerability in the Parental Control page of TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9 routers. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H indicates a network-accessible attack requiring high privileges (administrative authentication) with no user interaction, resulting in high impact across confidentiality, integrity, and availability. The vulnerability exists because the Parental Control feature passes user-supplied parameters directly to operating system commands executed on the router's embedded Linux environment. Shell metacharacters such as semicolons, pipes, backticks, or command substitution sequences are not filtered or escaped, allowing an authenticated administrator to inject arbitrary commands that execute with root privileges on the underlying system. The scope is unchanged (S:U), meaning impact is confined to the router itself, though a compromised router effectively controls all network traffic passing through it. The fix in firmware build 241108 addresses the vulnerability by sanitizing user input before it is incorporated into system commands.
Frequently Asked Questions
Is CVE-2025-9377 being actively exploited?
Yes. CISA has confirmed active exploitation by including CVE-2025-9377 in the Known Exploited Vulnerabilities catalog with a remediation deadline of September 24, 2025. The EPSS score of 15.6% at the 94th percentile further indicates significant exploitation activity targeting these TP-Link routers.
What products are affected by CVE-2025-9377?
CVE-2025-9377 affects TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9 routers running firmware versions prior to build 241108. Both products have reached end-of-life status, and TP-Link recommends replacing them with newer models for long-term security.
How do I fix CVE-2025-9377?
Apply the firmware patch (build 241108 or later) available from TP-Link's support page. Since both affected models are end-of-life, plan to replace them with actively supported hardware. In the interim, restrict administrative access, disable remote management, and monitor for signs of compromise.
How severe is CVE-2025-9377?
CVE-2025-9377 has a CVSS v3.1 base score of 7.2 (High severity). While the vulnerability requires administrative authentication, successful exploitation grants full command execution on the router with root-level privileges, enabling complete device compromise and network traffic interception.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.