CVE-2026-12935 in TL-WR940N
Summary
by MITRE • 07/29/2026
The TL-WR940N v6 router contains a vulnerability in its RTSP connection tracking module that can lead to a stack-based buffer overflow. The issue occurs when a LAN client initiates a connection to a malicious RTSP server controlled by an attacker. A specially crafted RTSP message may trigger improper memory handling within the kernel module
Successful exploitation of this vulnerability may result in a denial-of-service (DoS) condition or allow remote code execution (RCE), potentially leading to full compromise of the device. This vulnerability can be exploited by an unauthenticated attacker under the device's default configuration.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/29/2026
The TL-WR940N v6 router presents a critical stack-based buffer overflow vulnerability within its RTSP connection tracking module, representing a significant security risk for network infrastructure devices. This flaw exists in the kernel-level processing of RTSP protocol connections, specifically when handling incoming requests from LAN clients that connect to malicious RTSP servers controlled by adversaries. The vulnerability stems from inadequate input validation and improper memory management within the device's network processing stack, creating an exploitable condition that can be triggered through carefully crafted RTSP messages.
The technical implementation of this vulnerability follows a classic buffer overflow pattern where attacker-controlled data exceeds the allocated stack buffer space, potentially overwriting adjacent memory locations including return addresses and control flow information. This memory corruption can lead to unpredictable behavior ranging from system crashes and denial-of-service conditions to complete system compromise through remote code execution. The RTSP protocol connection tracking module fails to properly validate message lengths and content boundaries before processing incoming packets, allowing malicious data to overwrite kernel memory structures.
Operational impact of this vulnerability extends beyond simple service disruption as it provides a pathway for unauthenticated attackers to gain full control over the affected router. Under default configuration conditions, no authentication is required to exploit this weakness, making it particularly dangerous for widespread deployment scenarios. The device's role as a network gateway means successful exploitation could provide attackers with persistent access to internal networks, enabling lateral movement and further security breaches. This vulnerability directly impacts the confidentiality, integrity, and availability of network services managed by the compromised device.
Mitigation strategies should focus on immediate firmware updates from the vendor to address the buffer overflow condition in the RTSP module, while implementing network segmentation to isolate affected devices from critical infrastructure. Network monitoring solutions should be configured to detect anomalous RTSP traffic patterns that may indicate exploitation attempts. Organizations should also consider disabling RTSP functionality entirely if not required for business operations, and implement firewall rules to restrict RTSP port access from untrusted networks. This vulnerability aligns with CWE-121 stack-based buffer overflow and represents a potential ATT&CK technique involving privilege escalation and persistence mechanisms through network device compromise.