CVE-2023-36355

TP-Link TL-WR940N V4 was discovered to contain a buffer overflow via the ipStart parameter at ...

9.9 CriticalPublic exploit

TP-Link TL-WR940N V4 was discovered to contain a buffer overflow via the ipStart parameter at /userRpm/WanDynamicIpV6CfgRpm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

31.7%Up 31.7 points since Jun 23, 2023

What each source reports

NVD Score used 9.9

Record: CVE-2023-36355
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-120
Updated: 2026-11-02

CVE List No score

Record: CVE-2023-36355
Updated: 2026-11-02

EUVDEUVD-2023-40323 No score

Record: EUVD-2023-40323
Updated: 2026-11-03

GitHub AdvisoriesGHSA-p3q7-28hc-q76h 9.9

TP-Link TL-WR940N V4 was discovered to contain a buffer overflow via the ipStart parameter at ...

Record: GHSA-p3q7-28hc-q76h
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-120
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	TP-Link TL-WR940N V4 - Buffer OverFlow	2023-07-03

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-36355 is a critical vulnerability (CVSS 9.9) in Tp-link Tl-wr940n V4, published June 22, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 31.7%, the 98th percentile. No source names a fixed version.