CVE-2026-12935: Unauthenticated RCE in TP-Link TL-WR940N V6 (CVSS 8.7)

🚨 CVE-2026-12935: Unauthenticated RCE in TP-Link TL-WR940N V6 (CVSS 8.7)

A newly patched vulnerability in TP-Link's TL-WR940N V6 router lets attackers achieve remote code execution — no credentials, no direct user click required.

The bug

The flaw lives in the router's RTSP connection-tracking module:

1. Attacker stands up a malicious RTSP server
2. A LAN device (IP camera, smart TV, streaming client) initiates a connection to it
3. A crafted RTSP message triggers a stack-based buffer overflow in the kernel module
4. Result: DoS crash or full RCE

Why it matters

Routers sit at the network perimeter. A compromised device here isn't isolated — it becomes a pivot point for:

• DNS hijacking → phishing redirects
• Traffic interception (unencrypted sessions)
• Persistent malware surviving reboots
• Lateral movement to every other device on the LAN

The fix

TP-Link has shipped patched firmware for all regions:

• EN: V6_260528
• US: V6_260528
• JP: V6_260527

If you're running or supporting a TL-WR940N V6 in the field, check firmware version in the admin panel and patch immediately — this is unauthenticated and low-complexity to exploit.

Full writeup

Attack chain breakdown, detection commands, and a prevention checklist:
👉 https://www.xpert4cyber.com/2026/08/tp-link-cve-2026-12935-router-flaw.html