CVEvulnerability

CVE-2026-15141

5.3 MEDIUM Published 2026-08-12 Modified 2026-10-23 Official page ↗
Status
Analyzed
Published
2026-08-12
Last modified
2026-10-23
Assigner
f23511db-6c3e-4e32-a477-6aa17d310630
CVSS 4.0 (f23511db-6c3e-4e32-a477-6aa17d310630)
5.3 MEDIUM — CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
5.7 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-346

Description

The web interface of the affected device relies on the HTTP referrer header as part of request validation.  Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficient validation logic. Successful exploitation may allow an adjacent attacker with access to the web management interface to obtain device configuration details and other sensitive information.

Affected configurations

• tp-link tl-wr820n firmware (< 1.15.20)

Related

Weakness · CWE (1)

  • CWE-346 Origin Validation Error weakness

References