CVE-2022-25064

CriticalCVSS 9.8

Published: 25/02/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

36.22%

98th percentile - higher than 98% of all known CVEs

Summary

A remote code execution (RCE) vulnerability was discovered in TP-LINK TL-WR840N(ES) firmware version V6.20_180709 via the oal_wan6_setIpAddr function. An unauthenticated attacker can execute arbitrary code on the device.

Risk Assessment

An attacker can take full control of the router, modify its configuration, intercept network traffic, or use it as a pivot point for further attacks within the internal network.

Recommendation

Immediately update the router firmware to the latest available version or consider replacing the device with a model that has current vendor support.

Original NVD description (English source)

TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a remote code execution (RCE) vulnerability via the function oal_wan6_setIpAddr.