Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-11714: TP-Link TL‑WR840N/TL‑WR841N let anyone act without login

CVE-2018-11714 · published 8 years ago

Summary

The software inside TP‑Link TL‑WR840N (version 5) and TL‑WR841N (version 13) routers can be fooled into skipping the login step when a specially crafted web request is sent. This means an attacker could perform any administrative action on the router without permission. Install the latest firmware from TP‑Link as soon as possible, or temporarily disable remote web access until the update is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
tp-link	tl-wr840n_firmware	0.9.1_3.16 `cpe:2.3:o:tp-link:tl-wr840n_firmware:0.9.1_3.16:::::::*`
tp-link	tl-wr841n_firmware	0.9.1_4.16 `cpe:2.3:o:tp-link:tl-wr841n_firmware:0.9.1_4.16:::::::*`

Original advisory text

An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n devices. This issue is caused by improper session handling on the /cgi/ folder or a /cgi file. If an attacker sends a header of "Referer: http://192.168.0.1/mainFrame.htm" then no authentication is required for any action.

References

http://blog.securelayer7.net/time-to-disable-tp-link-home-wifi-router/ Exploit Third Party Advisory
https://www.exploit-db.com/exploits/44781/ Exploit Third Party Advisory VDB Entry

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

67% chance of attack within 30 days

Type

CWE-384Session Fixation

Timeline

Published4 Jun 2018

Updated12 Oct 2026

First seen29 Sep 2026

Sources

CVE-2018-11714 · NVD

Track software like this

Free during beta