A NULL pointer dereference occurs in the UPnP service of the TP‑Link TL‑WR841N v14 when it processes SOAP state variable query requests. The vulnerability is exploitable before any authentication is required, and a specially crafted SOAP query can trigger unexpected termination or instability of the process hosting the UPnP service. The resulting denial‑of‑service condition disrupts UPnP discovery, state query, and related management functions until the affected process is restarted or the device is rebooted.

The affected product is the TP‑Link TL‑WR841N router, specifically firmware version 14. No other versions are listed as vulnerable.

The CVSS score is 5.3, indicating moderate severity, and the vulnerability is not present in CISA’s KEV catalog. Because the UPnP service is exposed on the network, an attacker only needs to reach the device to send a crafted SOAP request. The lack of an EPSS score means no recent data on exploitation frequency is available. While the vulnerability does not provide remote code execution or data exfiltration, it can be leveraged to disrupt network discovery and management services, potentially affecting connectivity or automated management scripts.