CVE-2026-76649: CWE-476 NULL pointer dereference in TP-Link System Inc. TL-WR841N v14

This vulnerability is a NULL pointer dereference (CWE-476) in the UPnP service of TP-Link TL-WR841N v14. When the UPnP daemon processes a SOAP action request with unexpected XML content, it may dereference a NULL pointer causing the daemon to terminate unexpectedly. This leads to a denial-of-service condition affecting UPnP functionality until recovery actions such as service restart or device reboot are performed. No known exploits are reported in the wild. The CVSS 4.0 vector indicates the attack requires adjacent network access, no privileges, no user interaction, and results in low impact on availability.

Successful exploitation results in denial of service of the UPnP service on the affected device, disrupting UPnP functionality until the service is restarted or the device is rebooted. There is no indication of privilege escalation, data disclosure, or code execution. The impact is limited to availability of the UPnP service.

No official patch or fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, affected devices should consider disabling the UPnP service if it is not required to reduce exposure. Restarting the UPnP service or rebooting the device will restore functionality after an incident.