CVE-2017-13772: TP-Link WR940N router stack buffer overflow via web parameters

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityRemote authenticated code execution with a high CVSS score and high EPSS probability, though exploitation requires valid credentials and the device is not in KEV.

What it is

TP-Link WR940N WiFi routers (hardware version 4) contain multiple stack-based buffer overflows in the web management interface. The ping_addr parameter to PingIframeRpm.htm and the dnsserver2 parameter to WanStaticIpV6CfgRpm.htm can be overflowed by a remote authenticated user, leading to arbitrary code execution on the device.

Impact

An attacker with valid router credentials gains arbitrary code execution on the device, giving full control of the router's network traffic, configuration and any connected clients.

Attack surface

Reached over the network through the router's HTTP web management interface; the CVSS vector (AV:N/PR:L/UI:N) indicates the attacker must be authenticated but no user interaction is required.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.514, ~98.9th percentile) and public exploit code exists on Exploit-DB (43022) and Packet Storm, so exploitation is feasible and likely.

What to do

• Apply the vendor firmware fix for WR940N hardware version 4; if no fix is available, replace or retire the device.
• Restrict access to the router web management interface to trusted management networks and disable remote/WAN administration.
• Change default and weak administrative credentials and enforce strong unique passwords.
• Segment or isolate the router from sensitive internal networks to limit post-exploitation reach.

Detection

• Monitor router and perimeter logs for requests to PingIframeRpm.htm or WanStaticIpV6CfgRpm.htm with unusually long ping_addr or dnsserver2 parameter values.
• Alert on unexpected outbound connections or configuration changes originating from the router.
• Watch for router reboots, crashes or process restarts that may indicate failed overflow attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.