{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15141", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "state": "PUBLISHED", "assignerShortName": "TPLink", "dateReserved": "2026-07-08T17:23:13.249Z", "datePublished": "2026-08-12T22:35:58.962Z", "dateUpdated": "2026-08-13T13:11:50.851Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-08-12T22:35:58.962Z"}, "title": "Referer Validation Bypass in TL-WR820N Web Management Interface", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-346", "description": "CWE-346 Origin Validation Error", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-104", "descriptions": [{"lang": "en", "value": "CAPEC-104 Cross Zone Scripting"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "TL-WR820N v2", "versions": [{"status": "affected", "version": "0", "lessThan": "1.15.20 Build 260611 Rel.29552n", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The web\ninterface of the affected\ndevice relies on the HTTP referrer header as part of\nrequest validation.\u00a0 Requests\u00a0containing empty Referer value, or omitting\nthe Referer header entirely, may be accepted and processed due to insufficient\nvalidation logic.\n\n\n\n\n\nSuccessful exploitation may allow an adjacent attacker with access to the web management\ninterface to obtain device configuration details and other sensitive\ninformation.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The web\ninterface of the affected\ndevice relies on the HTTP referrer header as part of\nrequest validation.&nbsp; Requests&nbsp;containing empty Referer value, or omitting\nthe Referer header entirely, may be accepted and processed due to insufficient\nvalidation logic.</p>\n\n<p>Successful exploitation may allow an adjacent attacker with access to the web management\ninterface to obtain device configuration details and other sensitive\ninformation.</p>"}]}], "references": [{"url": "https://www.tp-link.com/kr/support/download/tl-wr820n/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/tl-wr820n/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/faq/5243/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Seong Hun Jeong (HunSec)", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}, "x_gcve": [{"vulnId": "CVE-2026-15141", "recordType": "advisory"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T13:11:43.168498Z", "id": "CVE-2026-15141", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T13:11:50.851Z"}}]}, "vulnerability-lookup:meta": {"epss": {"cve": "CVE-2026-15141", "date": "2026-11-08", "epss": "0.00178", "percentile": "0.07399"}, "nvd": "{\"cve\":{\"id\":\"CVE-2026-15141\",\"sourceIdentifier\":\"f23511db-6c3e-4e32-a477-6aa17d310630\",\"published\":\"2026-08-12T23:17:19.703\",\"lastModified\":\"2026-10-23T19:10:00.167\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The web\\ninterface of the affected\\ndevice relies on the HTTP referrer header as part of\\nrequest validation.\u00a0 Requests\u00a0containing empty Referer value, or omitting\\nthe Referer header entirely, may be accepted and processed due to insufficient\\nvalidation logic.\\n\\n\\n\\n\\n\\nSuccessful exploitation may allow an adjacent attacker with access to the web management\\ninterface to obtain device configuration details and other sensitive\\ninformation.\"},{\"lang\":\"es\",\"value\":\"La interfaz web del dispositivo afectado se basa en el encabezado HTTP Referer como parte de la validaci\u00f3n de solicitudes. Las solicitudes que contienen un valor Referer vac\u00edo, o que omiten el encabezado Referer por completo, pueden ser aceptadas y procesadas debido a una l\u00f3gica de validaci\u00f3n insuficiente.\\n\\nUna explotaci\u00f3n exitosa puede permitir a un atacante adyacente con acceso a la interfaz de gesti\u00f3n web obtener detalles de configuraci\u00f3n del dispositivo y otra informaci\u00f3n sensible.\"}],\"affected\":[{\"source\":\"f23511db-6c3e-4e32-a477-6aa17d310630\",\"affectedData\":[{\"vendor\":\"TP-Link Systems Inc.\",\"product\":\"TL-WR820N v2\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"1.15.20 Build 260611 Rel.29552n\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"f23511db-6c3e-4e32-a477-6aa17d310630\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.1,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-13T13:11:43.168498Z\",\"id\":\"CVE-2026-15141\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"f23511db-6c3e-4e32-a477-6aa17d310630\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-346\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:tp-link:tl-wr820n_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.15.20\",\"matchCriteriaId\":\"B2CE2B0A-5835-4395-B3A3-64D7DC436EC6\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:tp-link:tl-wr820n:2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB08E9FF-0EFD-49C0-97D3-B6313DF7E673\"}]}]}],\"references\":[{\"url\":\"https://www.tp-link.com/en/support/download/tl-wr820n/#Firmware\",\"source\":\"f23511db-6c3e-4e32-a477-6aa17d310630\",\"tags\":[\"Product\"]},{\"url\":\"https://www.tp-link.com/en/support/faq/5243/\",\"source\":\"f23511db-6c3e-4e32-a477-6aa17d310630\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.tp-link.com/kr/support/download/tl-wr820n/#Firmware\",\"source\":\"f23511db-6c3e-4e32-a477-6aa17d310630\",\"tags\":[\"Product\"]}]}}", "vulnrichment": {"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-15141\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-13T13:11:43.168498Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-13T13:11:48.151Z\"}}], \"cna\": {\"title\": \"Referer Validation Bypass in TL-WR820N Web Management Interface\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Seong Hun Jeong (HunSec)\"}], \"impacts\": [{\"capecId\": \"CAPEC-104\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-104 Cross Zone Scripting\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 5.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"ADJACENT\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"TP-Link Systems Inc.\", \"product\": \"TL-WR820N v2\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.15.20 Build 260611 Rel.29552n\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.tp-link.com/kr/support/download/tl-wr820n/#Firmware\", \"tags\": [\"patch\"]}, {\"url\": \"https://www.tp-link.com/en/support/download/tl-wr820n/#Firmware\", \"tags\": [\"patch\"]}, {\"url\": \"https://www.tp-link.com/en/support/faq/5243/\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.4\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"The web\\ninterface of the affected\\ndevice relies on the HTTP referrer header as part of\\nrequest validation.\\u00a0 Requests\\u00a0containing empty Referer value, or omitting\\nthe Referer header entirely, may be accepted and processed due to insufficient\\nvalidation logic.\\n\\n\\n\\n\\n\\nSuccessful exploitation may allow an adjacent attacker with access to the web management\\ninterface to obtain device configuration details and other sensitive\\ninformation.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"<p>The web\\ninterface of the affected\\ndevice relies on the HTTP referrer header as part of\\nrequest validation.&nbsp; Requests&nbsp;containing empty Referer value, or omitting\\nthe Referer header entirely, may be accepted and processed due to insufficient\\nvalidation logic.</p>\\n\\n<p>Successful exploitation may allow an adjacent attacker with access to the web management\\ninterface to obtain device configuration details and other sensitive\\ninformation.</p>\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-346\", \"description\": \"CWE-346 Origin Validation Error\"}]}], \"providerMetadata\": {\"orgId\": \"f23511db-6c3e-4e32-a477-6aa17d310630\", \"shortName\": \"TPLink\", \"dateUpdated\": \"2026-08-12T22:35:58.962Z\"}}}", "cveMetadata": "{\"cveId\": \"CVE-2026-15141\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-13T13:11:50.851Z\", \"dateReserved\": \"2026-07-08T17:23:13.249Z\", \"assignerOrgId\": \"f23511db-6c3e-4e32-a477-6aa17d310630\", \"datePublished\": \"2026-08-12T22:35:58.962Z\", \"assignerShortName\": \"TPLink\"}", "dataType": "CVE_RECORD", "dataVersion": "5.2"}}}