CVE-2025-9961: TP-Link Router Flaw Could Be Exploited for RCE, PoC Released

Security researchers at ByteRay have published a detailed exploitation write-up of CVE-2025-9961, a vulnerability in TP-Link’s CWMP (CPE WAN Management Protocol) service that can be weaponised to achieve remote code execution on affected devices. The report explains how mitigations such as NX and Partial RELRO were in place but that the absence of stack canaries and PIE left exploitable gaps, with ASLR entropy challenges noted.

ByteRay’s team described their process, including direct interaction with the system to monitor logs and set up GDB, and how they downgrading the firmware using a previously known flaw, CVE-2023-1389, to gain access for exploration. Their PoC initially relied on GenieACS but proved unreliable for delivering the full byte range, leading them to build a custom ACS server to reproduce CWMP protocol steps and push arbitrary payloads via SetParameterValues requests.

The researchers finally implemented a ret2libc attack to call system() in libc and served a malicious ARM32 ELF reverse shell, delivered through crafted curl and wget commands, with the complete PoC code published on GitHub.