Medium severity · published Sep 27, 2024
CVE-2024-9284
A vulnerability was found in TP-LINK TL-WR841ND up to 20240920
6.5
CVSS
1%
EPSS
No
On KEV
Description
A vulnerability was found in TP-LINK TL-WR841ND up to 20240920. It has been rated as critical. Affected by this issue is some unknown functionality of the file /userRpm/popupSiteSurveyRpm.htm. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TF
Tl-wr841nd Firmware · Tp-link
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9284
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9284
Broken Link
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TP-LINK/WR-841ND/popupSiteSurveyRpm.md
Permissions Required
https://vuldb.com/?ctiid.278684
Third Party Advisory
https://vuldb.com/?id.278684
Third Party Advisory
https://vuldb.com/?submit.411526
Product
https://www.tp-link.com/
More from Tl-wr841nd Firmware
7.5
CVE-2015-3035
TP-Link Multiple Archer Devices Directory Traversal Vulnerability
7.2
CVE-2025-9377
Authenticated RCE via Parental Control command injection
6.5
CVE-2023-50224
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability
7.5
CVE-2025-25901
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11, triggered by the dnsserver1 and dnsserver2 parameters at /userRpm/WanSlaacCfgRpm.htm
7.5
CVE-2025-25898
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the pskSecret parameter at /userRpm/WlanSecurityRpm.htm