CVE-2025-9377

What it actually does

This is an authenticated remote command execution vulnerability in the Parental Control page of TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9 routers running firmware older than build 241108. A logged-in attacker can send crafted input to the router’s web management interface that is interpreted by the underlying operating system as shell commands. Successful exploitation allows arbitrary command execution on the device, likely with high privileges typical of embedded router web services, enabling malware installation, configuration changes, traffic interception, pivoting, or disabling of security controls.

Why it matters to the business

Compromised edge routers can disrupt internet connectivity, expose internal network traffic, be enrolled into botnets, or be used as footholds for attacks against systems behind the router. The affected models are end-of-life, which increases operational risk because long-term security support is limited and replacement is the preferred remediation. This vulnerability is listed in CISA KEV with active exploitation in the wild and a remediation due date of 2025-09-24, so organizations should treat exposed or internet-manageable devices as urgent replacement or patch targets.

How an attack unfolds

An attacker first obtains authenticated access to the router administration interface, commonly through stolen credentials, weak/default passwords, credential reuse, prior compromise, or exposed remote management. The attacker then sends a crafted request to the Parental Control functionality containing operating-system command syntax in a vulnerable parameter. The router firmware fails to properly sanitize the input and passes it to a shell, causing the injected command to run on the device. After initial command execution, the attacker may retrieve a payload using tools such as wget, curl, or tftp, write it to a temporary filesystem location, make it executable, and run it. From there the device can be used for persistence where possible, botnet participation, traffic proxying, reconnaissance of the internal network, DNS manipulation, or as a launch point for additional attacks. Active exploitation has been reported against the TP-Link Archer C7(EU) and TL-WR841N/ND(MS) command injection issue, so internet-exposed management interfaces should be presumed high risk.

How to fix it

Replace affected devices where possible because both listed products are end-of-life. If immediate replacement is not feasible, install the vendor-provided patched firmware build 241108 or later for Archer C7(EU) V2 and TL-WR841N/ND(MS) V9. Disable remote administration from the internet, restrict management access to trusted internal administrative networks, change administrator passwords, and ensure default credentials are not in use. Where supported, disable unnecessary services such as UPnP, WAN-side management, telnet, and SSH. Rebooting alone is not sufficient because the underlying vulnerable firmware remains exploitable. If exploitation is suspected, back up only necessary configuration, factory reset the device, install fixed firmware, rotate router and Wi-Fi credentials, and review downstream systems for signs of lateral activity.

How to confirm the fix worked

Confirm the exact device model, hardware revision, region, and firmware build from the router administration interface or vendor tooling. Devices are considered exposed if Archer C7(EU) V2 or TL-WR841N/ND(MS) V9 are running firmware older than 241108. Verify that firmware build 241108 or later is installed, or that the device has been replaced with a supported model. Confirm that the web management interface is not reachable from the public internet and is restricted to trusted administrative hosts. Use external scanning from outside the network to ensure TCP management ports such as 80, 443, 8080, 8443, 22, and 23 are not exposed unless explicitly required and protected. After remediation, review logs and network telemetry to ensure there are no ongoing outbound connections from the router to unknown command-and-control, file-hosting, or suspicious IP addresses.

Typical attack path

1. Identify a vulnerable TP-Link Archer C7(EU) V2 or TL-WR841N/ND(MS) V9 device, especially one with remote web administration exposed.
2. Authenticate to the router web interface using valid, stolen, reused, or weak credentials.
3. Access or submit requests to the Parental Control page.
4. Inject shell metacharacters or command strings into a vulnerable Parental Control parameter.
5. Execute commands on the embedded operating system through the router web process.
6. Download and run additional tooling or malware from attacker-controlled infrastructure.
7. Modify router settings, enable services, proxy traffic, scan internal networks, or enroll the device into botnet infrastructure.

How to detect it

Because TP-Link consumer router logging is often limited, combine device logs with perimeter firewall, proxy, DNS, DHCP, NetFlow, and authentication telemetry. Look for successful router admin logins followed by requests to the Parental Control page, especially requests containing shell metacharacters such as semicolons, pipes, backticks, dollar-parentheses, or command names like wget, curl, tftp, sh, chmod, or busybox. Review whether the router management interface was reachable from the internet and whether unknown external IPs authenticated or attempted to authenticate. Hunt for outbound connections originating from the router’s management or WAN IP shortly after administrative activity, especially HTTP/HTTPS downloads, TFTP transfers, or connections to unusual high ports. On devices where shell or filesystem access is available during incident response, inspect temporary locations such as /tmp, /var/tmp, and /dev/shm for recently created executables, scripts, or files with random names. Check for unexpected configuration changes, enabled remote management, new DNS settings, port-forwarding rules, telnet/SSH enablement, unexplained reboots, or traffic spikes consistent with botnet activity. If indicators are found, treat the router as compromised: isolate it, preserve available logs/configuration, replace or reflash with fixed firmware, and rotate credentials.

• /userRpm/ParentCtrlRpm.htm
• ParentCtrlRpm.htm
• ;wget
• |wget
• `wget
• $(wget
• ;curl
• |curl
• `curl
• $(curl
• ;tftp
• |tftp
• `tftp
• $(tftp
• busybox wget
• chmod +x /tmp
• /tmp/.
• /var/tmp/.
• /dev/shm/
• telnetd
• dropbear
• iptables -F
• iptables -P INPUT ACCEPT
• nvram set
• uci set

What your security team should do

• Immediately inventory TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9 routers and identify firmware builds older than 241108.
• Prioritize remediation of any device with internet-exposed management because the vulnerability is in CISA KEV and has active exploitation in the wild.
• Replace affected end-of-life routers with supported hardware; if replacement is delayed, apply firmware build 241108 or later.
• Disable WAN-side administration and restrict router management interfaces to trusted administrative networks only.
• Rotate router administrator credentials and Wi-Fi credentials after patching or replacement, especially where compromise is suspected.
• Collect available router logs, firewall logs, DNS logs, proxy logs, and NetFlow for the period before remediation and hunt for suspicious command-download behavior.
• Factory reset and reimage or replace devices showing evidence of compromise rather than relying only on configuration cleanup.
• Monitor for outbound connections from router IP addresses to unknown HTTP, HTTPS, TFTP, or raw TCP services, particularly following administrative logins.