VulnSocial

CVE-2026-12935Disclosure

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The TL-WR940N v6 router contains a vulnerability in its RTSP connection tracking module that can lead to a stack-based buffer overflow. The issue occurs when a LAN client initiates a connection to a malicious RTSP server controlled by an attacker. A specially crafted RTSP message may trigger improper memory handling within the kernel module Successful exploitation of this vulnerability may result in a denial-of-service (DoS) condition or allow remote code execution (RCE), potentially leading to full compromise of the device. This vulnerability can be exploited by an unauthenticated attacker under the device's default configuration.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-121

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 8 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 5 signals
  • Technical details provided in 8 signals
  • Disclosure: 4 classified signals
  • Peaked 2d ago at 3 mentions (2026-08-03); latest day: 1
  • 8 total mentions across 4 days

Deep dive

Activity timeline8 mentions / 4d
01223Mentions · 2026-07-29: 2Mentions · 2026-08-03: 3Mentions · 2026-08-04: 2Mentions · 2026-08-10: 1Patch / Workaround · 2026-08-03: 2Patch / Workaround · 2026-08-04: 2Patch / Workaround · 2026-08-10: 1Technical Details · 2026-07-29: 2Technical Details · 2026-08-03: 3Technical Details · 2026-08-04: 2Technical Details · 2026-08-10: 107-2908-0308-0408-10
Signal classification2 categories
Disclosure
450.0%
Patch
450.0%
Referenced assets8 URLs
Classification over time
DateTotalLabels
2026-07-292
Disclosure2
2026-08-033
Disclosure1Patch2
2026-08-042
Disclosure1Patch1
2026-08-101
Patch1
Full discourse8 posts
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    A TP-Link TL-WR940N flaw, CVE-2026-12935, allows unauthenticated remote code execution via an RTSP stack buffer overflow. Update the router firmware now. #TPLink #TLWR940N #CVE202612935 #RCE #RouterSecurity #InfoSec http://securityonline.info/tp-link-wr940n-cve-2026-12935/

    Post summary

    The tweet alerts that the TP‑Link TL‑WR940N router is vulnerable to CVE‑2026‑12935, enabling unauthenticated RCE via an RTSP stack buffer overflow, and urges users to update firmware immediately.

    01111493
    12.6K followersView on X
  • iototsecnews@iototsecnews
    Patch

    TP-Link TL-WR940N ルーターの脆弱性 CVE-2026-12935 が FIX：未認証 RCE の可能性 https://iototsecnews.jp/2026/08/03/tp-link-tl-wr940n-router-flaw-lets-unauthenticated-attackers-execute-code-remotely/ TP-Link TL-WR940N v6 において、動画や音声の配信処理を行う機能の不備が存在しています。この問題の原因は、外部との通信時におけるデータ受け取り部分のメモリ管理不足にあります。悪用された場合、機器の不応答や遠隔からの不正な命令実行が引き起こされ、通信内容の盗聴や設定改竄につながる恐れがあります。特定された脆弱性は CVE-2026-12935 です。対応策として、開発元が供給する修正版ファームウェアへの更新が有効です。システムを安全に利用するためにも、管理用の接続情報を改定し、最新の更新プログラムを速やかに適用することが推奨されます。 #CVE202612935 #TPLink #Vulnerability

    Post summary

    The post reports the CVE‑2026‑12935 vulnerability in TP‑Link TL‑WR940N routers, highlighting a memory‑management bug that could allow unauthenticated remote code execution, and advises users to apply the vendor‑supplied firmware update promptly.

    01010238
    506 followersView on X
  • The Daily Tech Feed@dailytechonx
    Patch

    A critical vulnerability (CVE-2026-12935) in TP-Link TL-WR940N V6 routers allows unauthenticated remote code execution via RTSP conntrack. Users should update firmware immediately to mitigate risks. This flaw underscores the importance of timely firmware updates and vigilant network monitoring to protect against emerging threats. #CyberSecurity #TPLink #RouterVulnerability #RCE #FirmwareUpdate #NetworkSecurity https://thedailytechfeed.com/critical-vulnerability-in-tp-link-tl-wr940n-routers-allows-remote-code-execution/

    Post summary

    The post announces a critical RCE vulnerability in TP‑Link routers and urges immediate firmware updates to mitigate the risk.

    0000297
    601 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-12935 The TL-WR940N v6 router contains a vulnerability in its RTSP connection tracking module that can lead to a stack-based buffer overflow. The issue occurs when a LAN cl… https://www.cve.org/CVERecord?id=CVE-2026-12935 ----- Traducción: CVE-2026-12935 El … http://infoflow.cloud`

    Post summary

    The post announces CVE‑2026‑12935, detailing a stack-based buffer overflow vulnerability in the TL‑WR940N v6 router’s RTSP connection tracking module, but it provides no PoC, exploit code, patch, or evidence of active exploitation.

    0001046
    96 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-12935 The TL-WR940N v6 router contains a vulnerability in its RTSP connection tracking module that can lead to a stack-based buffer overflow. The issue occurs when a LAN cl… https://www.cve.org/CVERecord?id=CVE-2026-12935

    Post summary

    This source reports a stack‑based buffer overflow vulnerability in the RTSP connection tracking module of the TL‑WR940N v6 router.

    00010528
    57.9K followersView on X
  • Hackcoder_Y2K 💾@Hackcoder
    Patch

    🚨 VULNERABILIDAD CRÍTICA EN ROUTERS TP-LINK. TP-Link ha publicado un aviso de seguridad sobre una vulnerabilidad de severidad alta en el router TL-WR940N V6, identificada como CVE-2026-12935, que permite a atacantes no autenticados provocar denegación de servicio o ejecutar código remoto en dispositivos vulnerables. 🔍 DETALLES TÉCNICOS El fallo reside en el módulo de seguimiento de conexiones (conntrack) para RTSP, protocolo usado en sesiones de streaming multimedia. Este módulo procesa tráfico RTSP dentro del kernel del router. Según TP-Link, la causa es un desbordamiento de búfer basado en pila (stack-based buffer overflow), que ocurre cuando datos especialmente manipulados exceden la memoria asignada. ⚔️ VECTOR DE ATAQUE Un atacante puede desplegar un servidor RTSP malicioso y engañar a un dispositivo de la red local para que se conecte a él. Al recibir un mensaje RTSP malicioso, el módulo conntrack lo procesa incorrectamente, provocando corrupción de memoria en el kernel. Esto puede derivar en: ▪️ Caída del dispositivo (DoS) ▪️ Ejecución de código arbitrario ▪️ Alteración de configuración de red ▪️ Modificación de DNS ▪️ Instalación de malware persistente ▪️ Pivoteo hacia otros dispositivos de la LAN 📊 SEVERIDAD CVSS v4.0: 8.7/10 (Alto) Vector: red, baja complejidad, sin autenticación requerida Nota: requiere interacción del usuario (el cliente LAN debe conectarse al servidor RTSP malicioso) 🛠️ REMEDIACIÓN TP-Link confirmó que la vulnerabilidad afecta específicamente al hardware TL-WR940N V6. Firmwares corregidos disponibles: ▪️ (EN)_V6_260528 ▪️ (US)_V6_260528 ▪️ (JP)_V6_260527 Verificar versión de hardware y región antes de actualizar. Descargar únicamente desde el portal oficial de soporte de TP-Link. ✅ RECOMENDACIONES (ISO 27001 - Anexo A.8.8, A.8.9) ▪️ Aplicar actualización de firmware de inmediato. ▪️ Limitar conexiones RTSP salientes no necesarias desde la red local. ▪️ Monitorear tráfico RTSP inusual, reinicios inesperados o cambios de configuración. ▪️ Segmentar dispositivos IoT/streaming de la red corporativa. Fuente: https://cybersecuritynews.com/tp-link-rce-vulnerability/ #HInsideSecurity #CyberSecurity #TPLink #RCE #Vulnerabilidad #InfoSec #RedTeam #IoTSecurity

    Post summary

    El texto anuncia la vulnerabilidad CVE-2026-12935, ofrece detalles técnicos y alienta la actualización de firmware para mitigar el riesgo.

    0000075
    865 followersView on X
  • Rıdvan Yağlı@ridvanyagli
    Disclosure

    🔴 TP-Link TL-WR940N V6 Kablosuz Router'da güvenlik açığı tespit edildi! (CVE-2026-12935) TL-WR940N V6 modelinde bulunan yüksek önem dereceli bir güvenlik açığı, özel hazırlanmış RTSP yanıtlarıyla uzaktan kod çalıştırma (RCE) veya cihazın çökmesine (DoS) neden olabiliyor. Saldırının gerçekleşebilmesi için ağdaki bir cihazın saldırganın hazırladığı RTSP sunucusuna bağlanması gerekiyor. Başarılı bir istismarda saldırgan Router üzerinde kod çalıştırabiliyor, DNS ayarlarını değiştirebiliyor, Ağ trafiğini izleyebiliyor, Kalıcı yazılım yükleyebiliyor, Yerel ağdaki diğer sistemlere saldırabiliyor. Çözüm için TP-Link'in yayınladığı en güncel firmware'i yükleyin ve güncelleme yapılana kadar gereksiz RTSP trafiğini sınırlandırın: https://www.tp-link.com/tr/support/download/tl-wr940n/v6/?app=

    Post summary

    A critical RCE/DoS vulnerability (CVE‑2026‑12935) was identified in the TP‑Link TL‑WR940N V6 router, and TP‑Link urges users to update firmware and restrict RTSP traffic.

    00000248
    1.4K followersView on X
  • キタきつね@foxbook
    Disclosure

    TP-Link TL-WR940N CVE-2026-12935 認証なしでのリモートコード実行を可能にする脆弱性 TP-Link TL-WR940N CVE-2026-12935 Allows Unauthenticated Remote Code Execution #DailyCyberSecurity (Aug 3) https://securityonline.info/tp-link-wr940n-cve-2026-12935/

    Post summary

    The post announces the CVE‑2026‑12935 vulnerability in TP‑Link TL‑WR940N, noting unauthenticated remote code execution, but offers no PoC, exploit, patch, or active exploitation details.

    00000254
    4.9K followersView on X

Explore more

Back to dashboard