TP-Link Router Zero-Day Lets Attackers Execute Code by Bypassing ASLR

Researchers have uncovered a zero‑day in TP-Link routers that allows attackers to bypass ASLR and remotely execute arbitrary code, tracked as CVE-2025-9961 in the CWMP (TR-069) binary and triggered by malformed SOAP requests. According to ByteRay’s team, the flaw stems from an unchecked stack‑based buffer overflow in the CWMP parameter‑setting routine, and a crafted payload delivered via a custom ACS server can overwrite the program counter and hijack execution flow despite ASLR.

The exploit uses a ret2libc approach to spawn a reverse shell by loading a malicious ELF binary after brute‑forcing the base address and restarting the CWMP service when needed; a final curl payload fetches and executes the shell. TP-Link has released firmware updates addressing CVE‑2025‑9961 by adding input length checks and enabling full RELRO and stack canaries, with administrators advised to upgrade immediately and disable remote ACS configuration unless required.

Strong web UI credentials and restricting TR‑069 access to trusted networks are recommended defence‑in‑depth measures. The vulnerability highlights the risks posed by flawed management protocols and insufficient binary hardening, and timely patching remains critical.