CVE-2026-15141: CWE-346 Origin Validation Error in TP-Link Systems Inc. TL-WR820N v2
The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficient validation logic. Successful exploitation may allow an adjacent attacker with access to the web management interface to obtain device configuration details and other sensitive information.
AI Analysis
Technical Summary
The TP-Link TL-WR820N v2 web interface uses the HTTP Referer header as part of its request validation process. Due to insufficient validation logic, requests that have an empty Referer header or omit the Referer header entirely may be accepted and processed. This origin validation error (CWE-346) can be exploited by an attacker with adjacent network access to the device's management interface to retrieve sensitive configuration information.
Potential Impact
An attacker with adjacent network access to the device's web management interface may exploit this vulnerability to obtain device configuration details and other sensitive information. This could lead to further attacks or unauthorized device control depending on the information obtained. The CVSS 4.0 base score is 5.3 (medium severity), reflecting the limited attack vector (adjacent network) and low complexity but no required privileges or user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented. Until a patch is available, restrict access to the device's web management interface to trusted networks and users only.
CVE-2026-15141: CWE-346 Origin Validation Error in TP-Link Systems Inc. TL-WR820N v2
Description
The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficient validation logic. Successful exploitation may allow an adjacent attacker with access to the web management interface to obtain device configuration details and other sensitive information.
CVSS v4.0
Score 5.3medium
Affected software
TP-Link Systems Inc.
TL-WR820N v2
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The TP-Link TL-WR820N v2 web interface uses the HTTP Referer header as part of its request validation process. Due to insufficient validation logic, requests that have an empty Referer header or omit the Referer header entirely may be accepted and processed. This origin validation error (CWE-346) can be exploited by an attacker with adjacent network access to the device's management interface to retrieve sensitive configuration information.
Potential Impact
An attacker with adjacent network access to the device's web management interface may exploit this vulnerability to obtain device configuration details and other sensitive information. This could lead to further attacks or unauthorized device control depending on the information obtained. The CVSS 4.0 base score is 5.3 (medium severity), reflecting the limited attack vector (adjacent network) and low complexity but no required privileges or user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented. Until a patch is available, restrict access to the device's web management interface to trusted networks and users only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- TPLink
- Date Reserved
- 2026-07-08T17:23:13.249Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a7cfa38bf8831d5394899a5
Added to database: 08/12/2026, 22:56:56 UTC
Last enriched: 08/12/2026, 23:17:02 UTC
Last updated: 09/25/2026, 13:47:43 UTC
Views: 67
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.