CVE-2019-17147

This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-LINK TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 80 by default. When parsing the Host request header, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length static buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-8457.

• CWE-120
• CWE-120

• https://www.tp-link.com/us/support/download/tl-wr841n/#FirmwareProduct
• https://www.zerodayinitiative.com/advisories/ZDI-19-992/Third Party Advisory, VDB Entry
• https://www.tp-link.com/us/support/download/tl-wr841n/#FirmwareProduct
• https://www.zerodayinitiative.com/advisories/ZDI-19-992/Third Party Advisory, VDB Entry

Published

Jan 7, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-17141This vulnerability allows remote attackers to execute arbitr…8.8
• CVE-2019-17142This vulnerability allows remote attackers to execute arbitr…8.8
• CVE-2019-17143This vulnerability allows remote attackers to disclose sensi…4.3
• CVE-2019-17144This vulnerability allows remote attackers to execute arbitr…8.8
• CVE-2019-17145This vulnerability allows remote attackers to execute arbitr…8.8
• CVE-2019-17146This vulnerability allows remote attackers to execute arbitr…9.8
• CVE-2019-17148This vulnerability allows local attackers to escalate privil…7.8
• CVE-2019-17149Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…
• CVE-2019-1715A vulnerability in the Deterministic Random Bit Generator (D…7.5
• CVE-2019-17150Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…
• CVE-2019-17151This vulnerability allows remote attackers redirect users to…5.4
• CVE-2019-1716A vulnerability in the web-based management interface of Ses…7.5