CVE-2026-76649: Pre-Authentication NULL Pointer Dereference in UPnP SOAP Action Request Processing in TP-Link TL-WR841N
A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP action requests. A specially crafted SOAP action request containing unexpected XML content may cause the UPnP daemon to terminate unexpectedly.
Successful exploitation may result in a denial-of-service condition affecting UPnP functionality until the service is restarted or the device is rebooted.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker able to send SOAP action requests to the router's UPnP service can trigger the condition. The issue is described as pre-authentication, so no prior login is required.
What functionality is affected if exploitation succeeds?
The UPnP daemon may terminate unexpectedly, causing a denial of service for UPnP functionality. UPnP remains unavailable until the service is restarted or the device is rebooted.
What can be done while a firmware update is not available or cannot be installed?
The provided information identifies the UPnP service as the affected component. Disabling or otherwise preventing access to UPnP would avoid processing the crafted UPnP SOAP action requests, but the data does not specify device configuration steps.