Critical TP-Link TL-WR940N Flaw Lets Attackers Remotely Execute Code

Key Takeaways

• A severe vulnerability (CVE-2026-12935) has been identified in TP-Link’s TL-WR940N V6 wireless router.
• The flaw, a stack-based buffer overflow, could enable unauthenticated remote code execution or denial-of-service.
• Exploitation requires a local network client to connect to a malicious RTSP server.
• TP-Link has released firmware updates for various regional versions to patch the vulnerability.

Critical Flaw Discovered in TP-Link TL-WR940N V6 Routers

TP-Link has issued a critical security advisory concerning a high-severity vulnerability, designated CVE-2026-12935, impacting its TL-WR940N V6 wireless router. This flaw creates an avenue for unauthenticated attackers to potentially achieve remote code execution or trigger a denial-of-service condition on susceptible devices, albeit under specific circumstances.

Technical Details of the Vulnerability

The core of the issue resides within the router’s kernel, specifically within the Real-Time Streaming Protocol (RTSP) connection tracking (conntrack) feature. RTSP is a protocol commonly employed for controlling multimedia streaming sessions. The vulnerable module is responsible for processing RTSP-related network traffic, and its improper handling of data leads to the security weakness.

According to TP-Link’s analysis, the vulnerability is a stack-based buffer overflow. This occurs when an application attempts to write more data to a memory buffer than it was designed to hold, overwriting adjacent memory regions. Attackers can trigger this by crafting malicious data that exceeds the allocated memory space.

Exploitation Mechanism and Impact

Exploiting CVE-2026-12935 requires an attacker to operate a malicious RTSP server. A device on the local network must then be enticed to connect to this attacker-controlled server. Once a LAN client initiates a connection, the malicious RTSP server can transmit a specially crafted, harmful RTSP message.

Upon receiving this malicious message, the vulnerable conntrack module within the router processes the data incorrectly, leading to memory corruption in the device’s kernel. This corruption can manifest in two primary ways: either causing the router to crash, resulting in a denial-of-service attack, or, more critically, enabling the execution of arbitrary code controlled by the attacker.

Successful remote code execution on a router presents a significant security threat. An attacker could gain control over the device, allowing them to modify network settings, intercept network traffic, alter DNS configurations, install persistent malware, or use the compromised router as a pivot point to launch further attacks against other devices connected to the local network.

Severity and Mitigation

The vulnerability has been assigned a CVSS v4.0 score of 8.7 out of 10, classifying it as High severity. Its attack vector is network-based, characterized by low attack complexity and requiring no authentication. However, user interaction is a prerequisite for exploitation, as a local network client must initiate the connection to the malicious RTSP server.

TP-Link confirmed that the vulnerability exclusively affects the TL-WR940N hardware version V6. The company has proactively released firmware updates to address this issue across various regional models. These include firmware version (EN)_V6_260528 for English-language devices, (US)_V6_260528 for US-specific devices, and (JP)_V6_260527 for Japanese market devices.

Users are strongly advised to verify their router’s exact hardware version and regional firmware edition before proceeding with any updates. Installing firmware intended for an incorrect regional model can lead to operational problems or device malfunction. All firmware updates should exclusively be downloaded from TP-Link’s official support portal to ensure authenticity and integrity.

TP-Link has credited Ryo Shimada of Powder Keg Technologies, Inc. for the responsible disclosure of this vulnerability.

What You Should Do

• Update Firmware Immediately: The most crucial step is to download and install the latest firmware update for your TP-Link TL-WR940N V6 router from the official TP-Link support website. Ensure you select the correct firmware version corresponding to your router’s hardware version and regional model.
• Limit RTSP Connections: Until your router is updated, restrict unnecessary outbound RTSP connections from devices within your local network.
• Monitor Network Activity: Network administrators should actively monitor for unusual RTSP traffic, unexpected router reboots, or unauthorized configuration changes, as these could signal attempted exploitation.
• Download Only from Official Sources: Always obtain firmware updates exclusively from TP-Link’s official support portal to prevent installing malicious or corrupted software.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.