CVE-2026-12935

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12935", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "state": "PUBLISHED", "assignerShortName": "TPLink", "dateReserved": "2026-06-22T18:48:17.939Z", "datePublished": "2026-07-29T18:20:06.417Z", "dateUpdated": "2026-07-30T03:55:40.565Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-07-29T18:20:06.417Z"}, "title": "Unauthenticated Remote Code Execution in TP-Link TL-WR940N RTSP Conntrack Feature", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-121", "description": "CWE-121 Stack-based buffer overflow", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "TL-WR940N v6", "versions": [{"status": "affected", "version": "0", "lessThan": "(US)_V6_260528", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "(JP)_V6_260527", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "(EU)_V6_260528", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The\nTL-WR940N v6 router contains a vulnerability in its RTSP connection tracking\nmodule that can lead to a stack-based buffer overflow. The issue occurs when a\nLAN client initiates a connection to a malicious RTSP server controlled by an\nattacker. A specially crafted RTSP message may trigger improper memory handling\nwithin the kernel module\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation of this vulnerability may result in a denial-of-service (DoS)\ncondition or allow remote code execution (RCE), potentially leading to full\ncompromise of the device. This vulnerability can be exploited by an\nunauthenticated attacker under the device's default configuration.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The\nTL-WR940N v6 router contains a vulnerability in its RTSP connection tracking\nmodule that can lead to a stack-based buffer overflow. The issue occurs when a\nLAN client initiates a connection to a malicious RTSP server controlled by an\nattacker. A specially crafted RTSP message may trigger improper memory handling\nwithin the kernel module</p><p>\n\n</p><p>Successful\nexploitation of this vulnerability may result in a denial-of-service (DoS)\ncondition or allow remote code execution (RCE), potentially leading to full\ncompromise of the device. This vulnerability can be exploited by an\nunauthenticated attacker under the device's default configuration.</p>"}]}], "references": [{"url": "https://www.tp-link.com/us/support/download/tl-wr940n/v6/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/tl-wr940n/v6/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/jp/support/download/tl-wr940n/v6/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/faq/5213/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Ryo Shimada, University of Tsukuba; Powder Keg Technologies, Inc.", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-29T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-12935"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-30T03:55:40.565Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12935", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-29T18:45:40.464526Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T18:45:44.850Z"}}], "cna": {"title": "Unauthenticated Remote Code Execution in TP-Link TL-WR940N RTSP Conntrack Feature", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Ryo Shimada, University of Tsukuba; Powder Keg Technologies, Inc."}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "TL-WR940N v6", "versions": [{"status": "affected", "version": "0", "lessThan": "(US)_V6_260528", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "(JP)_V6_260527", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "(EU)_V6_260528", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.tp-link.com/us/support/download/tl-wr940n/v6/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/tl-wr940n/v6/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/jp/support/download/tl-wr940n/v6/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/faq/5213/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "The\nTL-WR940N v6 router contains a vulnerability in its RTSP connection tracking\nmodule that can lead to a stack-based buffer overflow. The issue occurs when a\nLAN client initiates a connection to a malicious RTSP server controlled by an\nattacker. A specially crafted RTSP message may trigger improper memory handling\nwithin the kernel module\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation of this vulnerability may result in a denial-of-service (DoS)\ncondition or allow remote code execution (RCE), potentially leading to full\ncompromise of the device. This vulnerability can be exploited by an\nunauthenticated attacker under the device's default configuration.", "supportingMedia": [{"type": "text/html", "value": "<p>The\nTL-WR940N v6 router contains a vulnerability in its RTSP connection tracking\nmodule that can lead to a stack-based buffer overflow. The issue occurs when a\nLAN client initiates a connection to a malicious RTSP server controlled by an\nattacker. A specially crafted RTSP message may trigger improper memory handling\nwithin the kernel module</p><p>\n\n</p><p>Successful\nexploitation of this vulnerability may result in a denial-of-service (DoS)\ncondition or allow remote code execution (RCE), potentially leading to full\ncompromise of the device. This vulnerability can be exploited by an\nunauthenticated attacker under the device's default configuration.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based buffer overflow"}]}], "providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-07-29T18:20:06.417Z"}}}, "cveMetadata": {"cveId": "CVE-2026-12935", "state": "PUBLISHED", "dateUpdated": "2026-07-29T18:45:48.353Z", "dateReserved": "2026-06-22T18:48:17.939Z", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "datePublished": "2026-07-29T18:20:06.417Z", "assignerShortName": "TPLink"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "TL-WR940N v6", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "(US)_V6_260528", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "(JP)_V6_260527", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "(EU)_V6_260528", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The\nTL-WR940N v6 router contains a vulnerability in its RTSP connection tracking\nmodule that can lead to a stack-based buffer overflow. The issue occurs when a\nLAN client initiates a connection to a malicious RTSP server controlled by an\nattacker. A specially crafted RTSP message may trigger improper memory handling\nwithin the kernel module\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation of this vulnerability may result in a denial-of-service (DoS)\ncondition or allow remote code execution (RCE), potentially leading to full\ncompromise of the device. This vulnerability can be exploited by an\nunauthenticated attacker under the device's default configuration."}, {"lang": "es", "value": "El router TL-WR940N v6 contiene una vulnerabilidad en su m\u00f3dulo de seguimiento de conexiones RTSP que puede conducir a un desbordamiento de b\u00fafer basado en pila. El problema ocurre cuando un cliente de LAN inicia una conexi\u00f3n a un servidor RTSP malicioso controlado por un atacante. Un mensaje RTSP especialmente dise\u00f1ado puede desencadenar un manejo inadecuado de la memoria dentro del m\u00f3dulo del kernel.\n\nLa explotaci\u00f3n exitosa de esta vulnerabilidad puede resultar en una condici\u00f3n de denegaci\u00f3n de servicio (DoS) o permitir la ejecuci\u00f3n remota de c\u00f3digo (RCE), lo que podr\u00eda llevar a un compromiso total del dispositivo. Esta vulnerabilidad puede ser explotada por un atacante no autenticado bajo la configuraci\u00f3n predeterminada del dispositivo."}], "id": "CVE-2026-12935", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12935", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-29T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-07-29T19:16:44.113", "references": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/en/support/download/tl-wr940n/v6/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/jp/support/download/tl-wr940n/v6/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/us/support/download/tl-wr940n/v6/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/us/support/faq/5213/"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,(US)_V6_260528)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,(JP)_V6_260527)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,(EU)_V6_260528)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "tl-wr940n_v6", "vendor": "tp-link"}], "created": "2026-07-30T14:01:39.473084+00:00", "updated": "2026-08-03T13:15:05.179972+00:00", "vendors": ["tp-link", "tp-link$PRODUCT$tl-wr940n_v6"]}