CVE-2025-9377 TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection
Authenticated attackers can execute arbitrary commands on TP-Link Archer C7 and TL-WR841N routers via the Parental Control page.
- Exploited in the wild
- Since 3 Sep 2025
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-9377?
CVE-2025-9377 is a high-severity command injection vulnerability in TP-Link Systems Inc. Archer C7(EU) V2, published on 29 Aug 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9.
This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108.
Both products have reached the status of EOL (end-of-life). It's recommending to
purchase the new product to ensure better performance and security. If replacement is not an option in the short term, please use the second reference link to download and install the patch(es).
Weakness: CWE-78
Which versions are affected by CVE-2025-9377?
It affects 3 products.
Products include Tp-Link Archer C7 Firmware, Tp-Link Tl-Wr841n Firmware, Tp-Link Tl-Wr841nd Firmware.
How do I fix CVE-2025-9377?
No fix has been published for CVE-2025-9377 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 24 Sep 2025.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-9377 being exploited?
Yes. Attackers have exploited CVE-2025-9377 in the wild since at least 3 Sep 2025.
Other vulnerabilities in TP-Link Systems Inc. Archer C7(EU) V2
Sources
Also known as GHSA-37mx-8m3f-j8vm.