Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2025-9377

HighExploitedPublic exploit

The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9.

Published Aug 29, 2025 · Updated Feb 26, 2026

Key Facts

Patch immediately
  • CVE-2025-9377 is a high-severity vulnerability (CVSS 8.6 v4) affecting Archer C7 Firmware (Tp-Link), Tl-Wr841nd Firmware (Tp-Link), Tl-Wr841n Firmware (Tp-Link) and 2 more products.
  • It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Aug 29, 2025. Public exploit code is available.
  • EPSS estimates a 38% probability of exploitation in the next 30 days.
  • Fixed versions are available, including Archer C7(EU) V2 241108, TL-WR841N/ND(MS) V9 241108, Archer C7 Firmware 241108.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v4

8.6

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (30-day exploit likelihood)

38%

Higher than 98.5% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2025-9377 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9.

This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108.

Both products have reached the status of EOL (end-of-life). It's recommending to

purchase the new product to ensure better performance and security. If replacement is not an option in the short term, please use the second reference link to download and install the patch(es).

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
CISA KEVSep 3, 2025Sep 24, 2025Not reported
Industry KEV feedAug 29, 2025Sep 24, 2025Not reported
CIRCL KEVSep 3, 2025Sep 24, 2025Not reported
ENISA EUVDSep 3, 2025n/aNot reported

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected Products

5 affected entries in total
ProductAffected versionsFixed in
Archer C7 FirmwareTp-LinkSee advisory241108
Tl-Wr841nd FirmwareTp-LinkSee advisory241108
Tl-Wr841n FirmwareTp-LinkSee advisory241108
Archer C7(EU) V2See advisory241108
TL-WR841N/ND(MS) V9See advisory241108

Patched Releases

Archer C7(EU) V2

241108

TL-WR841N/ND(MS) V9

241108

Archer C7 Firmware

241108

Tl-Wr841n Firmware

241108

Tl-Wr841nd Firmware

241108

Timeline

  1. Publicly disclosed

    Aug 29, 2025

  2. Added to Industry KEV feed

    Aug 29, 2025

  3. Added to CISA KEV

    Sep 3, 2025

  4. Added to CIRCL KEV

    Sep 3, 2025

  5. Added to ENISA EUVD

    Sep 3, 2025

  6. Last updated

    Feb 26, 2026

Weakness Type

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

References

3 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2025-9377 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo