TP-Link has recently disclosed a significant security flaw in its TL-WR940N V6 wireless routers, identified as CVE-2026-12935. This vulnerability enables unauthenticated attackers to potentially execute remote code or cause a denial-of-service (DoS) condition on affected devices.
Technical Details of the Vulnerability
The issue originates from a stack-based buffer overflow within the router’s Real-Time Streaming Protocol (RTSP) connection tracking module. RTSP is commonly utilized for managing multimedia streaming sessions. In this case, the vulnerable module processes RTSP-related network traffic within the router’s kernel—the core component of its operating system.
An attacker can exploit this flaw by operating a malicious RTSP server and persuading a device on the local network to connect to it. When a LAN client interacts with the attacker-controlled RTSP server, it can return a specially crafted RTSP message. The vulnerable conntrack module may then mishandle this data, leading to memory corruption within the router’s kernel. This can result in the device crashing (DoS attack) or, under certain conditions, allow the execution of attacker-controlled code.
Potential Impact
Successful exploitation of this vulnerability poses severe security risks. An attacker with remote code execution capabilities could alter network configurations, intercept or reroute traffic, modify DNS settings, install persistent malware, or use the compromised router as a launchpad for attacks on other devices within the local network.
The vulnerability has been assigned a CVSS v4.0 score of 8.7 out of 10, categorizing it as high severity. The attack vector is network-based, with low complexity and no authentication required. However, user interaction is necessary, as a LAN client must initiate a connection to the malicious RTSP server for exploitation to occur.
Affected Devices and Mitigation
TP-Link has confirmed that this vulnerability specifically affects the TL-WR940N hardware version V6. To address the issue, the company has released firmware updates for supported regional versions, including:
- Firmware version (EN)_V6_260528 for English devices
- Firmware version (US)_V6_260528 for US devices
- Firmware version (JP)_V6_260527 for Japanese devices
Users are advised to verify their router’s hardware version and regional firmware edition before installing updates, as using firmware intended for a different regional model may lead to operational issues or device malfunction. Firmware updates should be downloaded exclusively from TP-Link’s official support portal.
Until the router is updated, it is recommended that organizations and home users limit unnecessary outbound RTSP connections from devices on their local networks. Network administrators should monitor for unusual RTSP traffic, unexpected router reboots, or configuration changes that could indicate attempted exploitation.
TP-Link has credited Ryo Shimada of Powder Keg Technologies, Inc. for responsibly disclosing this vulnerability. Prompt installation of the firmware update remains the primary mitigation strategy for CVE-2026-12935.
This incident underscores the critical importance of timely firmware updates and vigilant network monitoring. As routers serve as gateways to home and organizational networks, vulnerabilities within them can have far-reaching consequences. Users should regularly check for firmware updates and apply them promptly to safeguard their networks against emerging threats.
