Authenticated RCE via Parental Control command injection
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 241108
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
This vulnerability affects TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9 router firmware, allowing a logged-in user to run arbitrary system commands through the Parental Control page. Successful exploitation could let an attacker take full control of the affected router.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9. This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108. Both products have reached the status of EOL (end-of-life). It's recommending to purchase the new product to ensure better performance and security. If replacement is not an option in the short term, please use the second reference link to download and install the patch(es).
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- TP-Link Systems Inc. Archer C7(EU) V2
fixed in 241108
- TP-Link Systems Inc. TL-WR841N/ND(MS) V9
fixed in 241108
References 2
tp-link.com
Questions about CVE-2025-9377
What does this mean?
The Parental Control page in these TP-Link routers fails to properly handle the url_0 parameter, so a crafted value can inject commands that the router runs. Successful use of this flaw gives code execution on the router.Source: tp-link.com, tp-link.com
Am I affected, and how do I check?
The listed products are Archer C7(EU) V2 and TL-WR841N/ND(MS) V9 firmware with versions before 241108. The flaw is only reachable when the remote administration interface is enabled to the internet, which is not the default setting, so check that setting and the firmware build in the router's admin pages.Source: tp-link.com, tp-link.com
What should I do about it?
Update to firmware build 241108 or later, as TP-Link strongly recommends updating to the latest firmware. No fixed version beyond 241108 is named in the facts, so use the latest firmware available from TP-Link.Source: tp-link.com, tp-link.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-09-03, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data