Statement on cross-site scripting (XSS) vulnerability on TP-Link WR841N (CVE-2025-25427)

Vulnerability Description:

A stored cross-site scripting (XSS) vulnerability in the upnp.htm page of the web Interface in TP-Link WR841N v14/v14.6/v14.8 <= Build 241230 Rel. 50788n allows remote attackers to inject arbitrary JavaScript code via the port mapping description. This leads to an execution of the JavaScript payload when the upnp page is loaded.

Impact:

This XSS can be used to execute arbitrary JavaScript code and steal the admin password.

CVSS v4.0 Score: 8.6 / High

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:N/SA:L

Affected Products/Versions and Fixes:

Recommendations:

We strongly recommended that users with affected devices take the following actions:

1. Download and update to the latest firmware to fix the vulnerabilities.
2. Change the password after the firmware upgrade to mitigate the potential risk of password leakage.

The latest firmware of related models and download links are below:

Download for TL-WR841N | TP-Link

Download for TL-WR841N | TP-Link.

Disclaimer:

If you do not take all of the recommended actions, this vulnerability concern will remain. TP-Link cannot bear any responsibility for the consequences that could have been avoided by following the recommended actions in this statement.