---
id: "CVE-2025-9377"
kind: "vulnerability"
aliases: ["CVE-2025-9377"]
title: "The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer\u2026"
severity: "high"
cvss: 8.6
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "TP-Link Multiple Routers", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tp-link tl-wr841n firmware", "fixed": ["241108"], "affected": "< 241108", "ecosystem": "vendor"}, {"name": "tp-link tl-wr841nd firmware", "fixed": ["241108"], "affected": "< 241108", "ecosystem": "vendor"}, {"name": "tp-link archer c7 firmware", "fixed": ["241108"], "affected": "< 241108", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "home-network", "infrastructure", "routers", "self-hosted", "tp-link"]
not_affected_if: ["other-tp-link-models", "parental-control-disabled"]
published_at: "2025-08-29T18:15:43+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-9377", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9377", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer…

TP-Link Archer C7(EU) and TL-WR841N/ND(MS) routers have an OS command injection flaw in the Parental Control page. An attacker can run operating system commands on the router, which is a foothold on the home or office network.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:TP-Link Multiple Routers affected ? fixed ?
- vendor:tp-link tl-wr841n firmware affected < 241108 fixed 241108
- vendor:tp-link tl-wr841nd firmware affected < 241108 fixed 241108
- vendor:tp-link archer c7 firmware affected < 241108 fixed 241108

## How to check

Check the router model on the device label or admin page; if it is an Archer C7(EU) or TL-WR841N/ND(MS), treat it as affected.

## Fix

Discontinue use of the product if no vendor mitigation is available, per CISA guidance; the sources say these models may be end-of-life or end-of-service.
Apply any vendor-provided mitigation or firmware update if one exists (unknown from sources).

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-9377
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-9377

## From the sources

The authenticated remote command execution (RCE) vulnerability exists  in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9.

This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108.

Both products have reached the status of EOL (end-of-life).
It's recommending to 

purchase the new 
product to ensure better performance and security. If replacement is not
 an option in the short term, please use the second reference link to 
download and install the patch(es).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_