CVE-2026-15141

The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficient validation logic. Successful exploitation may allow an adjacent attacker with access to the web management interface to obtain device configuration details and other sensitive information.

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.tp-link.com/en/support/download/tl-wr820n/#Firmware	Product
https://www.tp-link.com/en/support/faq/5243/	Vendor Advisory
https://www.tp-link.com/kr/support/download/tl-wr820n/#Firmware	Product

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:tp-link:tl-wr820n_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:tl-wr820n:2.0:*:*:*:*:*:*:*

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) La interfaz web del dispositivo afectado se basa en el encabezado HTTP Referer como parte de la validación de solicitudes. Las solicitudes que contienen un valor Referer vacío, o que omiten el encabezado Referer por completo, pueden ser aceptadas y procesadas debido a una lógica de validación insuficiente. Una explotación exitosa puede permitir a un atacante adyacente con acceso a la interfaz de gestión web obtener detalles de configuración del dispositivo y otra información sensible.

Information

Published : 2026-08-12 23:17

Updated : 2026-10-23 19:10

NVD link : CVE-2026-15141

Mitre link : CVE-2026-15141

CVE.ORG link : CVE-2026-15141

JSON object : View

Products Affected

tp-link

tl-wr820n_firmware
tl-wr820n

CWE

CWE-346

Origin Validation Error

{"id": "CVE-2026-15141", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15141", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T13:11:43.168498Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.1}], "cvssMetricV40": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "affectedData": [{"vendor": "TP-Link Systems Inc.", "product": "TL-WR820N v2", "versions": [{"status": "affected", "version": "0", "lessThan": "1.15.20 Build 260611 Rel.29552n", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-12T23:17:19.703", "references": [{"url": "https://www.tp-link.com/en/support/download/tl-wr820n/#Firmware", "tags": ["Product"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/en/support/faq/5243/", "tags": ["Vendor Advisory"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/kr/support/download/tl-wr820n/#Firmware", "tags": ["Product"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "description": [{"lang": "en", "value": "CWE-346"}]}], "descriptions": [{"lang": "en", "value": "The web\ninterface of the affected\ndevice relies on the HTTP referrer header as part of\nrequest validation.\u00a0 Requests\u00a0containing empty Referer value, or omitting\nthe Referer header entirely, may be accepted and processed due to insufficient\nvalidation logic.\n\n\n\n\n\nSuccessful exploitation may allow an adjacent attacker with access to the web management\ninterface to obtain device configuration details and other sensitive\ninformation."}, {"lang": "es", "value": "La interfaz web del dispositivo afectado se basa en el encabezado HTTP Referer como parte de la validaci\u00f3n de solicitudes. Las solicitudes que contienen un valor Referer vac\u00edo, o que omiten el encabezado Referer por completo, pueden ser aceptadas y procesadas debido a una l\u00f3gica de validaci\u00f3n insuficiente.\n\nUna explotaci\u00f3n exitosa puede permitir a un atacante adyacente con acceso a la interfaz de gesti\u00f3n web obtener detalles de configuraci\u00f3n del dispositivo y otra informaci\u00f3n sensible."}], "lastModified": "2026-10-23T19:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-wr820n_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B2CE2B0A-5835-4395-B3A3-64D7DC436EC6", "versionEndExcluding": "1.15.20"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-wr820n:2.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BB08E9FF-0EFD-49C0-97D3-B6313DF7E673"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630"}