CVE-2025-9377 - CVE House

Back to Database

Status published High CVE-2025-9377

Authenticated RCE via Parental Control command injection

8.6 CVSS

Vulnerability Description

The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9. This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108. Both products have reached the status of EOL (end-of-life). It's recommending to purchase the new product to ensure better performance and security. If replacement is not an option in the short term, please use the second reference link to download and install the patch(es).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-9377

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from TP-Link Systems Inc.

View All →

Authenticated RCE by CWMP binary

Blind Server-Side Request Forgery (SSRF) in Omada Controller

Password Confirmation Bypass in Omada Controller

IDOR Leading to Owner Account Hijacking in Omada Controller

Insufficient Certificate Validation in Multiple Mobile Applications Allows Man in the Middle Interception

Affected Vendor

TP-Link Systems Inc.

View all reports →

Affected Software

Archer C7(EU) V2, TL-WR841N/ND(MS) V9

Vulnerable Versions:

0

Timeline

Official Publish: August 29th, 2025

Last Modified: February 26th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1005 Data from Local System

T1041 Exfiltration Over C2 Channel