CVE-2022-25061

CriticalCVSS 9.8

Published: 25/02/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

66.93%

99th percentile - higher than 99% of all known CVEs

Summary

A command injection vulnerability was discovered in TP-LINK TL-WR840N(ES) firmware version V6.20_180709 via the component oal_setIp6DefaultRoute. An attacker can remotely execute arbitrary system commands without authentication.

Risk Assessment

The risk involves potential full device takeover by an unauthenticated attacker, leading to local network compromise and traffic interception.

Recommendation

Immediately update the router firmware to the latest available version or consider replacing the device with a supported model.

Original NVD description (English source)

TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_setIp6DefaultRoute.