{"id":"CVE-2026-15141","state":"PUBLISHED","title":"Referer Validation Bypass in TL-WR820N Web Management Interface","description":"The web\ninterface of the affected\ndevice relies on the HTTP referrer header as part of\nrequest validation.  Requests containing empty Referer value, or omitting\nthe Referer header entirely, may be accepted and processed due to insufficient\nvalidation logic.\n\n\n\n\n\nSuccessful exploitation may allow an adjacent attacker with access to the web management\ninterface to obtain device configuration details and other sensitive\ninformation.","publishedAt":"2026-08-12T22:35:58.962Z","updatedAt":"2026-08-13T13:11:50.851Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","source":"TPLink"},"assigner":"TPLink","products":["TP-Link Systems Inc. TL-WR820N v2"],"affected":[{"vendor":"TP-Link Systems Inc.","product":"TL-WR820N v2","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.15.20 Build 260611 Rel.29552n","versionType":"custom"}]}],"references":["https://www.tp-link.com/kr/support/download/tl-wr820n/#Firmware","https://www.tp-link.com/en/support/download/tl-wr820n/#Firmware","https://www.tp-link.com/en/support/faq/5243/"],"weaknesses":["CWE-346"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/15xxx/CVE-2026-15141.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-15141","state":"PUBLISHED","datePublished":"2026-08-12T22:35:58.962Z","dateUpdated":"2026-08-13T13:11:50.851Z","assignerShortName":"TPLink","assignerOrgId":"f23511db-6c3e-4e32-a477-6aa17d310630","dateReserved":"2026-07-08T17:23:13.249Z"},"containers":{"cna":{"title":"Referer Validation Bypass in TL-WR820N Web Management Interface","descriptions":[{"lang":"en","value":"The web\ninterface of the affected\ndevice relies on the HTTP referrer header as part of\nrequest validation.  Requests containing empty Referer value, or omitting\nthe Referer header entirely, may be accepted and processed due to insufficient\nvalidation logic.\n\n\n\n\n\nSuccessful exploitation may allow an adjacent attacker with access to the web management\ninterface to obtain device configuration details and other sensitive\ninformation."}],"affected":[{"vendor":"TP-Link Systems Inc.","product":"TL-WR820N v2","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.15.20 Build 260611 Rel.29552n","versionType":"custom"}]}],"references":[{"url":"https://www.tp-link.com/kr/support/download/tl-wr820n/#Firmware","tags":["patch"]},{"url":"https://www.tp-link.com/en/support/download/tl-wr820n/#Firmware","tags":["patch"]},{"url":"https://www.tp-link.com/en/support/faq/5243/","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":5.3,"vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-346","lang":"en","description":"CWE-346 Origin Validation Error","type":"CWE"}]}],"providerMetadata":{"shortName":"TPLink","orgId":"f23511db-6c3e-4e32-a477-6aa17d310630","dateUpdated":"2026-08-12T22:35:58.962Z"},"impacts":[{"capecId":"CAPEC-104","descriptions":[{"lang":"en","value":"CAPEC-104 Cross Zone Scripting"}]}],"credits":[{"lang":"en","value":"Seong Hun Jeong (HunSec)","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.4"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-13T13:11:43.168498Z","id":"CVE-2026-15141","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-13T13:11:50.851Z"}}]}}}