CVE-2022-25062
HighCVSS 7.5Exploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
An integer overflow vulnerability was discovered in the TP-LINK TL-WR840N(ES) router firmware version V6.20_180709, specifically in the dm_checkString function. This flaw allows an attacker to cause a Denial of Service (DoS) via a crafted HTTP request.
Risk Assessment
An attacker can remotely crash the device, leading to network disruption and loss of internet access for users.
Recommendation
Immediately update the router firmware to the latest available version that fixes this vulnerability. If no update is available, restrict management interface access to trusted networks only.
Other vulnerabilities in TP-LINK TL-WR840N(ES)
See all- CVE-2022-25064Critical
A remote code execution (RCE) vulnerability was discovered in TP-LINK TL-WR840N(ES) firmware version V6.20_180709 via the oal_wan6_setIpAddr function. An unauthenticated attacker can execute arbitrary code on the device.
- CVE-2022-25061Critical
A command injection vulnerability was discovered in TP-LINK TL-WR840N(ES) firmware version V6.20_180709 via the component oal_setIp6DefaultRoute. An attacker can remotely execute arbitrary system commands without authentication.
- CVE-2022-25060Critical
A command injection vulnerability was discovered in TP-LINK TL-WR840N(ES) firmware version V6.20_180709. The flaw resides in the oal_startPing component.
Original NVD description (English source)
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain an integer overflow via the function dm_checkString. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.