Volerion logoVolerion
Volerion logoVolerion

TP-Link TL-WR940N Buffer Overflow Vulnerability Allowing Arbitrary Code Execution

Vulnerability

A buffer overflow vulnerability has been identified in TP-Link TL-WR940N versions 3 and 4, running firmware through 3.16.9. The issue arises in the '/userRpm/Wan6to4TunnelCfgRpm.htm' endpoint, where the 'dnsserver1' and 'dnsserver2' parameters can be manipulated. This vulnerability allows authenticated attackers to execute arbitrary code on the device with root privileges.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected device, with the executed code running as the root user.

Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM

Vulnerability Rating

Custom Algorithm
spread
6.8
impact
7.5
exploitability
4.9
remediation
0.0
relevance
0.0
threat
0.1
urgency
2.9
incentive
0.8

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.