CVE-2019-17147

HIGH

TP-LINK TL-WR841N Firmware - Unauthenticated Remote Code Execution via Host Header Buffer Overflow

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2019-17147. PoCs published by DrmnSamoLiu, imnot-ye.

AI-analyzed exploit summary This repository provides detailed instructions and firmware binaries for downgrading a TP-Link WR841N router to a vulnerable version to reproduce CVE-2019-17147. It includes technical steps for flashing partitions and debugging tools like busybox and gdbserver.

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-LINK TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 80 by default. When parsing the Host request header, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length static buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-8457.

Exploits (2)

nomisec WRITEUP 4 stars
by DrmnSamoLiu · poc
https://github.com/DrmnSamoLiu/CVE-2019-17147_Practice_Material

This repository provides detailed instructions and firmware binaries for downgrading a TP-Link WR841N router to a vulnerable version to reproduce CVE-2019-17147. It includes technical steps for flashing partitions and debugging tools like busybox and gdbserver.

Classification
Writeup 95%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: TP-Link WR841N firmware (TW) 0.9.1 4.16 v009e.0 Build 180516 Rel.81030n
No auth needed
Prerequisites: Physical access to the router · Serial console access · TFTP server setup
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WRITEUP 1 stars
by imnot-ye · poc
https://github.com/imnot-ye/CVE-2019-17147

The repository contains firmware files and scripts from a vulnerable device, likely a router, associated with CVE-2019-17147. The files include configuration scripts and JavaScript files, but no explicit exploit code is present. The content appears to be extracted firmware for analysis rather than a functional exploit.

Classification
Writeup 80%
Attack Type
Other
Complexity
Moderate
Reliability
Theoretical
Target: Unknown router firmware (likely affected by CVE-2019-17147)
No auth needed
Prerequisites: Access to vulnerable firmware · Knowledge of firmware extraction and analysis
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry x_refsource_misc
https://www.zerodayinitiative.com/advisories/ZDI-19-992/

Scores

CVSS v3 8.8
EPSS 0.1376
EPSS Percentile 96.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-120
Status published
Products (1)
tp-link/tl-wr841n_firmware 0.9.1_4.16
Published Jan 07, 2020
Tracked Since Feb 18, 2026