CVE Alert: CVE-2025-9377 – TP-Link Systems Inc. – Archer C7(EU) V2

Risk verdict

Active exploitation of an authenticated RCE via the Parental Control page is present; treat as urgent.

Why this matters

Authenticated attackers can run OS commands on the router, potentially taking control of the device and enabling access to the internal network. With these models being EOL, patch availability is limited, elevating long-term risk and complicating remediation for home and small-office deployments.

Most likely attack path

The attacker would need network access to the device’s web interface and valid credentials. From there, command injection through the Parental Control page can yield arbitrary code execution with high privileges, enabling device takeover or persistence. Lateral movement is unlikely beyond the router’s LAN-facing scope, but a compromised gateway can facilitate access to connected devices.

Who is most exposed

Home users and small offices deploying these TP-Link models are most at risk, especially where devices remain on factory defaults or lack ongoing updates due to EOL status.

Detection ideas

• Unusual command executions or process spawns originating from the router’s web UI.
• Suspicious or malformed requests to the Parental Control endpoint.
• Authorized sessions or login activity from WAN/IPs outside normal patterns.
• Unexpected changes to Parental Control settings or firmware state.
• Anomalous outbound traffic after authentication (to internal hosts or external destinations).

Mitigation and prioritisation

• Apply the vendor patch or firmware update where available; if the device is EOL, prioritise patching within maintenance windows or plan replacement.
• Disable or limit Parental Control features and restrict remote/admin access; segment the router from sensitive internal assets.
• Replace EOL devices with supported models; ensure robust credential policies and disable default credentials.
• Implement network-level controls to restrict unauthenticated access to the management interface; monitor for anomalous admin activity.
• Establish detection and response playbooks; log and alert on Parental Control UI activity and rapid changes to security-relevant settings.