The vulnerability arises from improper validation of UPnP input on TP‑Link TL‑Wr841n routers running firmware v14. Malformed data can trigger an out‑of‑bounds read, causing the UPnP daemon to crash. As a result, the device’s UPnP functionality becomes unavailable, effectively denying legitimate network traffic that relies on UPnP discovery or configuration. The weakness is a classic buffer overread (CWE‑125).

Attackers can impact TP‑Link TL‑Wr841n routers with firmware versions before EN_0.9.1 4.19 Build 260303 Rel.42399n (V14_260303) and before US_0.9.1.4.19 Build 260312 Rel.49108n (V14_0304). They are all identified as product TL‑Wr841n version 14 and are issued by TP‑Link Systems Inc.

The CVSS base score of 7.1 conveys high severity, while the EPSS score indicates that active exploitation is unlikely to be widespread (<1 %). The vulnerability is not part of the CISA KEV catalog. Exploitation requires network access to the UPnP port and a crafted request. A successful exploit would continuously bring the UPnP service down, causing a denial of service that affects only the router’s service layer and not the underlying firmware. While the impact does not lead to code execution, repeated service crashes can degrade network usability for affected users.