Insufficient Request Validation in TP-Link TL-WR820N Web Management Interface
CVE-2026-15141

5.3MEDIUM

Key Information:

Vendor

Tp-link Systems Inc.

Status
Tl-wr820n V2
Vendor
CVE Published:
12 August 2026

What is CVE-2026-15141?

The web management interface of the TP-Link TL-WR820N relies on the HTTP referrer header for validating requests. Due to a flaw in this validation logic, requests that lack a Referer header or contain an empty value may be processed without proper checks. This oversight can potentially allow adjacent attackers with access to the web management interface to extract sensitive information, including device configurations.

Affected Version(s)

TL-WR820N v2 0 < 1.15.20 Build 260611 Rel.29552n

References

https://www.tp-link.com/kr/support/download/tl-wr820n/#Fi...
patch
https://www.tp-link.com/en/support/download/tl-wr820n/#Fi...
patch
https://www.tp-link.com/en/support/faq/5243/
vendor-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Seong Hun Jeong (HunSec)
.