TP-Link TL-WR940N RTSP Connection Tracking stack-based overflow

Summaryinfo

A vulnerability identified as very critical has been detected in TP-Link TL-WR940N. This impacts an unknown function of the component RTSP Connection Tracking Module. The manipulation leads to stack-based overflow. This vulnerability is traded as CVE-2026-12935. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in TP-Link TL-WR940N. This issue affects some unknown functionality of the component RTSP Connection Tracking Module. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The TL-WR940N v6 router contains a vulnerability in its RTSP connection tracking module that can lead to a stack-based buffer overflow. The issue occurs when a LAN client initiates a connection to a malicious RTSP server controlled by an attacker. A specially crafted RTSP message may trigger improper memory handling within the kernel module Successful exploitation of this vulnerability may result in a denial-of-service (DoS) condition or allow remote code execution (RCE), potentially leading to full compromise of the device. This vulnerability can be exploited by an unauthenticated attacker under the device's default configuration.

It is possible to read the advisory at tp-link.com. The identification of this vulnerability is CVE-2026-12935 since 06/22/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/29/2026).

Upgrading to version (EU)_V6_260528, (JP)_V6_260527 or (US)_V6_260528 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• TP-Link

Name

• TL-WR940N

License

• commercial

Website

• Vendor: https://www.tp-link.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion