CVE-2025-9377

HIGHCVSS 7.2Known Exploited

CISA Known Exploited Vulnerability

https://www.tp-link.com/us/support/faq/4308/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-9377

Remediation deadline: September 24, 2025

Description

TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Timeline

Published:August 29th, 2025 6:15 PM

Last modified:October 18th, 2026 9:10 PM

Added to KEV:September 3rd, 2025

CVSS Scoring

CVSS v3: 7.2 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected Software

From NVD CPE configuration data

Vendors

tp-link

Products

tl-wr841n_firmwaretl-wr841nd_firmwarearcher_c7_firmware

Weaknesses (CWE)

CWE-78

References & Reports

Advisories, patches, and third-party reports

https://www.tp-link.com/us/support/faq/4308/Product
https://www.tp-link.com/us/support/faq/4365/Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9377US Government Resource

Source: NIST NVD · Data may lag official sources by up to one minute