OS Command Injection in TP‑Link Archer C7(EU) & TL‑WR841N/ND(MS) Routers (CVE‑2025‑9377)
What It Is — A remote OS command injection flaw resides in the Parental Control page of TP‑Link Archer C7 (EU) and TL‑WR841N/ND (MS) routers. An attacker can inject arbitrary system commands via a crafted HTTP request, potentially taking full control of the device.
Exploitability — The vulnerability is publicly disclosed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and proof‑of‑concept code has been shared. No vendor patch is yet available for the end‑of‑life models, making exploitation realistic.
Affected Products — TP‑Link Archer C7 (EU) and TP‑Link TL‑WR841N/ND (MS) home/SMB routers. Many units are already end‑of‑life (EoL) or end‑of‑service (EoS).
Why It Matters for Trust & Control Assurance
- Continuous vulnerability monitoring – The flaw underscores the need for an ongoing inventory and scanning program that feeds evidence into a control‑mapping repository.
- Patch‑and‑replace discipline – Demonstrating timely remediation (or justified de‑commissioning) provides defensible audit evidence for governance frameworks such as NIST CSF 2.0.
- Supply‑chain risk visibility – Legacy networking gear creates blind spots that can be exploited to pivot into broader corporate environments, eroding the trust posture of any organization that relies on it.
Recommended Actions
- Conduct an immediate inventory of all TP‑Link Archer C7 and TL‑WR841N/ND devices across your environment.
- Verify firmware versions; if a patch is unavailable, isolate or replace the devices per your asset‑retirement policy.
- Feed the findings into your continuous control‑mapping platform to generate evidence of remediation for audit readiness.
- Update your vulnerability‑management process to flag end‑of‑life networking equipment as high‑risk.
Source: CISA KEV – CVE‑2025‑9377