How the TP-Link 0-Day Bypasses ASLR: A Technical Post-Mortem

A critical zero-day remote code execution (RCE) vulnerability, identified as CVE-2025-9961, with CVSS and EPSS scores of 8.6 and 0.10% respectively, has been discovered in TP-Link routers. Security researchers have released a proof-of-concept (PoC) exploit, demonstrating how attackers can bypass Address Space Layout Randomization (ASLR) protections to gain full control over affected devices. This vulnerability poses a significant risk to TP-Link router users, potentially allowing attackers to intercept traffic, launch further attacks on the local network, or enlist the device in a botnet.

The vulnerability resides in the router’s Customer Premises Equipment (CPE) WAN Management Protocol (CWMP) binary, a component of the TR-069 protocol used by service providers for remote device management. The core issue is a stack-based buffer overflow within the cwmp process. By sending a malicious request, attackers can overwrite the program counter (PC) and seize control of the execution flow.

However, the presence of ASLR, a security feature that randomizes the memory addresses of key data areas, presents a significant hurdle. To bypass ASLR, the researchers devised a brute-force strategy. Since the exploit did not involve an information leak to disclose memory layouts, they repeatedly guessed the base address of the standard C library (libc) to locate the system() function.

The research team encountered a problem where the standard GenieACS platform corrupted the binary payload, preventing successful exploitation. This forced them to develop a custom ACS emulator capable of faithfully transmitting the exploit code.

The attack workflow requires the router to be configured to accept the attacker’s custom Auto Configuration Server (ACS). The exploit is delivered through a SetParameterValues request containing the payload. An incorrect guess of the libc base address would crash the cwmp service, but the researchers noted that an attacker with access to the TP-Link web panel could simply restart the service, making the brute-force attack practical.

The final payload uses a return-to-libc (ret2libc) technique to call the system() function with a command argument. This command instructs the router to download and execute a malicious binary (e.g., a reverse shell) from an attacker-controlled server, granting the attacker complete remote access.

Successful exploitation of CVE-2025-9961 lets an authenticated attacker execute arbitrary code on affected TP-Link AX10/AX1500 devices, which can lead to full device takeover, creation of botnet or malware footholds, interception or exfiltration of LAN traffic and credentials, local network pivoting to attack connected hosts, and denial-of-service or device bricking, overall a high-severity compromise of confidentiality, integrity, and availability on vulnerable routers.

Users of TP-Link routers are advised to monitor for firmware updates from the vendor and apply them as soon as they become available to patch this vulnerability. Given the severity of the vulnerability and the availability of a PoC exploit, it is crucial to apply updates promptly.

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.