CVE-2025-9377
high-risk
Published 2025-08-29
The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9. This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108. Both products have reached the status of EOL (end-of-life). It's recommending to purchase the new product to ensure better performance and security. If replacement is not an option in the short term, please use the second reference link to download and install the patch(es).
Do I need to act?
!
15.6% chance of exploitation in next 30 days
EPSS score — higher than 84% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.2/10
High
NETWORK
/ LOW complexity
Affected Products (3)
Affected Vendors
References (3)
Vendor Advisory
https://www.tp-link.com/us/support/faq/4365/
US Government Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-...
55
/ 100
high-risk
Severity
26/34 · High
Exploitability
20/34 · Moderate
Exposure
9/34 · Low