The TP-Link TL-WR820N v2 web interface uses the HTTP Referer header as part of its request validation process. Due to insufficient validation logic, requests that have an empty Referer header or omit the Referer header entirely may be accepted and processed. This origin validation error (CWE-346) can be exploited by an attacker with adjacent network access to the device's management interface to retrieve sensitive configuration information.

An attacker with adjacent network access to the device's web management interface may exploit this vulnerability to obtain device configuration details and other sensitive information. This could lead to further attacks or unauthorized device control depending on the information obtained. The CVSS 4.0 base score is 5.3 (medium severity), reflecting the limited attack vector (adjacent network) and low complexity but no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented. Until a patch is available, restrict access to the device's web management interface to trusted networks and users only.