CVEvulnerability
CVE-2018-25321
5.3 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2026-05-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 5.3 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-352
Description
TP-Link TL-WR720N wireless router contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious web requests. Attackers can modify port forwarding rules via VirtualServerRpm.htm or change WiFi security settings via WlanSecurityRpm.htm by tricking authenticated users into visiting attacker-controlled pages.
Affected configurations
• tp-link tl-wr720n firmware (<= v1 130719)
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- https://static.tp-link.com/resources/software/TL-WR720N_V1_130719.zip Product
- https://www.exploit-db.com/exploits/44335 Exploit, Third Party Advisory, VDB Entry
- https://www.tp-link.com/ Product
- https://www.vulncheck.com/advisories/tp-link-tl-wr720n-all-versions-csrf-via-administrative-interfaces Third Party Advisory