High severity · published Jan 7, 2020
CVE-2019-17147
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-LINK TL-WR841N routers
8.8
CVSS
13.7%
EPSS
No
On KEV
Description
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-LINK TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 80 by default. When parsing the Host request header, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length static buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-8457.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)13.7% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TF
Tl-wr841n Firmware · Tp-link
0.9.1_4.16 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-17147
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-17147
Product
https://www.tp-link.com/us/support/download/tl-wr841n/#Firmware
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-19-992/
More from Tl-wr841n Firmware
8.8
CVE-2023-33538
TP-Link Multiple Routers Command Injection Vulnerability
7.5
CVE-2015-3035
TP-Link Multiple Archer Devices Directory Traversal Vulnerability
7.2
CVE-2025-9377
Authenticated RCE via Parental Control command injection
6.5
CVE-2023-50224
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability
9.8
CVE-2022-25073
TL-WR841Nv14_US_0.9.1_4.18 routers were discovered to contain a stack overflow in the function dm_fillObjByStr()