CVE-2025-9377

TP-Link Archer C7 (EU) and TL-WR841N/ND (MS) routers contain an OS command injection vulnerability (CWE-78) in the Parental Control page of the device's web management interface. By submitting crafted input through that page, an attacker can execute arbitrary operating-system commands on the router with device-level privileges. Users of these specific models are affected, and CISA notes the products may be end-of-life (EoL) and/or end-of-service (EoS), which may limit the availability of fixes. The flaw was added to CISA's KEV catalog on 2025-09-03, indicating known active exploitation in the wild; no public proof-of-concept is known and ransomware use has not been confirmed. EPSS estimates a 33.5% probability of exploitation within the next 30 days (98th percentile), a relatively high likelihood given the vulnerability is unscored.

What to do: Inventory networks for Archer C7 (EU) and TL-WR841N/ND (MS) routers and apply the latest firmware from TP-Link if an update is offered for the specific hardware variant. Because the devices may be EoL/EoS and a patch may not be available, CISA's required action is to apply vendor mitigations (or BOD 22-01 guidance for federal agencies) or discontinue use of the product; as interim mitigation, disable WAN-side/remote web management, restrict the admin interface to trusted LAN access, and use strong administrator credentials.