CVE-2022-25060

CriticalCVSS 9.8

Published: 25/02/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

48.18%

99th percentile - higher than 99% of all known CVEs

Summary

A command injection vulnerability was discovered in TP-LINK TL-WR840N(ES) firmware version V6.20_180709. The flaw resides in the oal_startPing component.

Risk Assessment

An attacker can remotely execute arbitrary system commands on the device, potentially leading to full compromise of the router and network security.

Recommendation

Immediately update the device firmware to the latest available version. If no update is available, consider replacing the device with a supported model.

Original NVD description (English source)

TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_startPing.