CVE-2026-15141Medium· 5.7▾ SunlitThe web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficie…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 31.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.1%
0.1% → 0.2%
The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficient validation logic.
Successful exploitation may allow an adjacent attacker with access to the web management interface to obtain device configuration details and other sensitive information.
tl-wr820n_firmware < 1.15.20Upgrade past the affected range:
tl-wr820n_firmware 1.15.20Connected by shared product, vendor, weakness, or advisory.
CVE-2025-14175Medium· 6.5A vulnerability in the SSH server of TP-Link TL-WR820N v2.80 allows the use of a weak cryptographic algorithm, enabling an adjacent attacker to intercept and decrypt SSH traffic. Exploitation may expose sensitive information and compromi…
CVE-2026-22222High· 8.0An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and Archer AXE75 v2 (web modules) allows adjacent authenticated attacker to execute arbitrary code. Successful exploitation could allow an attacker to gain full admin…
CVE-2025-9290Medium· 5.9An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values
CVE-2018-25321Medium· 4.3TP-Link TL-WR720N CSRF via Administrative Interfaces (firmware V1_130719)
CVE-2025-62673High· 8.0Heap-based Buffer Overflow vulnerability in Archer AX53 v1.0 and AX12 v1.0 (tdpserver modules) allows adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet containin…
CVE-2026-22223High· 8.0An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and BE3600 v1 (vpn modules) allows adjacent authenticated attacker execute arbitrary code. Successful exploitation could allow an attacker to gain full administrati…