The TL‑WR940N v6 router contains a stack‑based buffer overflow in its RTSP connection‑tracking kernel module. A malicious RTSP message, crafted by an attacker, can corrupt the stack when a LAN client initiates communication with an attacker‑controlled RTSP server. The overflow can lead to denial of service or allow the attacker to execute arbitrary code on the device, a classic example of CWE‑121.

The affected device is the TP‑Link Systems Inc. TL‑WR940N v6 router running the default firmware configuration. Only this model and firmware version are listed as impacted in the CNA data.

The vulnerability has a CVSS score of 8.7 and an EPSS score of less than 1 %, indicating a high severity but low exploitation probability. It is not listed in the CISA KEV catalog. The attack requires an unauthenticated LAN client that can reach a malicious RTSP server controlled by the attacker. Once the crafted RTSP packet is processed by the kernel module, the attacker can trigger the buffer overflow, leading to a DoS or remote code execution, potentially compromising the entire device.