CVE-2025-15606
Received Received - Intake
Denial-of-Service in TP-Link TD-W8961N httpd via Input Sanitization Flaw

Publication date: 2026-03-23

Last updated on: 2026-03-31

Assigner: TPLink

Description
A Denial-of-Service (DoS) vulnerability in the httpd component of TP-Link's TD-W8961N v4.0 due to improper input sanitization, allows crafted requests to trigger a processing error that causes the httpd service to crash. Successful exploitation may allow the attacker to cause service interruption, resulting in a DoS condition.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-23
Last Modified
2026-03-31
Generated
2026-06-16
AI Q&A
2026-03-23
EPSS Evaluated
2026-06-14
NVD
CVE-2025-15606
EUVD
EUVD-2025-208944
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
tp-link td-w8961nd_firmware to 250925 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a Denial-of-Service (DoS) issue in the httpd component of the TP-Link TD-W8961N router, specifically version 4.0 and earlier firmware versions prior to V4_250925.

It occurs due to improper input sanitization in the HTTP daemon (httpd), which allows an attacker to send specially crafted HTTP requests that trigger a processing error.

This processing error causes the httpd service to crash, resulting in a denial-of-service condition that interrupts the device’s network service availability.

Impact Analysis

[{'type': 'paragraph', 'content': 'Successful exploitation of this vulnerability can cause the httpd service on the affected TP-Link TD-W8961N router to crash.'}, {'type': 'paragraph', 'content': "This crash leads to a denial-of-service condition, meaning the device's network services become unavailable or interrupted."}, {'type': 'paragraph', 'content': 'If the device is not updated with the fixed firmware version (V4_250925 or later), the vulnerability remains exploitable, potentially causing repeated service interruptions.'}] [2]

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate the CVE-2025-15606 vulnerability in the TP-Link TD-W8961N router, you should immediately update the device firmware to version V4_250925 or later, which contains a fix for the input sanitization flaw in the httpd component.

Since the TD-W8961N model has reached end-of-life, it is also strongly recommended to upgrade to a supported TP-Link model to receive ongoing automatic security updates.

Failure to apply the firmware update or upgrade the device leaves the vulnerability exploitable, potentially causing service interruptions due to denial-of-service conditions.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15606. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart