CVE-2026-12935

{
  "id": "CVE-2026-12935",
  "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630",
  "published": "2026-07-29T19:16:44.113",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The\nTL-WR940N v6 router contains a vulnerability in its RTSP connection tracking\nmodule that can lead to a stack-based buffer overflow. The issue occurs when a\nLAN client initiates a connection to a malicious RTSP server controlled by an\nattacker. A specially crafted RTSP message may trigger improper memory handling\nwithin the kernel module\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation of this vulnerability may result in a denial-of-service (DoS)\ncondition or allow remote code execution (RCE), potentially leading to full\ncompromise of the device. This vulnerability can be exploited by an\nunauthenticated attacker under the device's default configuration."
    },
    {
      "lang": "es",
      "value": "El router TL-WR940N v6 contiene una vulnerabilidad en su módulo de seguimiento de conexiones RTSP que puede conducir a un desbordamiento de búfer basado en pila. El problema ocurre cuando un cliente de LAN inicia una conexión a un servidor RTSP malicioso controlado por un atacante. Un mensaje RTSP especialmente diseñado puede desencadenar un manejo inadecuado de la memoria dentro del módulo del kernel.\n\nLa explotación exitosa de esta vulnerabilidad puede resultar en una condición de denegación de servicio (DoS) o permitir la ejecución remota de código (RCE), lo que podría llevar a un compromiso total del dispositivo. Esta vulnerabilidad puede ser explotada por un atacante no autenticado bajo la configuración predeterminada del dispositivo."
    }
  ],
  "affected": [
    {
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "affectedData": [
        {
          "vendor": "TP-Link Systems Inc.",
          "product": "TL-WR940N v6",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "(US)_V6_260528",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "(JP)_V6_260527",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "(EU)_V6_260528",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "PASSIVE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-29T00:00:00+00:00",
          "id": "CVE-2026-12935",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.tp-link.com/en/support/download/tl-wr940n/v6/#Firmware",
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630"
    },
    {
      "url": "https://www.tp-link.com/jp/support/download/tl-wr940n/v6/#Firmware",
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630"
    },
    {
      "url": "https://www.tp-link.com/us/support/download/tl-wr940n/v6/#Firmware",
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630"
    },
    {
      "url": "https://www.tp-link.com/us/support/faq/5213/",
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630"
    }
  ]
}