External risk intelligence

TP-LINK TL-WR840N Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-25060

This vulnerability affects a consumer wireless router. Such devices are typically deployed at the edge of a network, often with management interfaces that may be exposed or reachable from the local network, and are intended to act as the primary gateway for internet connectivity.

OS Command Injection

Tp Link Tl Wr840n Firmware

6.20_180709

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in TP-Link TL-WR840N routers that could allow attackers to inject malicious commands through a specific component, potentially enabling unauthorized control over affected devices. The primary concern is to determine if this specific technology is in use within your environment and, if so, to what extent it is exposed.

Vulnerability allows remote attackers to run commands.
This impacts consumer network edge devices.
Confirm if this router model is in use.

Attack Path

How an attacker could exploit the issue

An attacker can reach this device over the network without needing any credentials or user interaction. By sending specially crafted requests to the `oal_startPing` component, they can execute arbitrary commands on the router. This could allow them to take control of the device and potentially disrupt network services or redirect traffic.

No authentication or user interaction needed.
Triggered via crafted requests to `oal_startPing`.
Risk of command execution and network disruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary commands on the affected device when the oal_startPing component is triggered. This could lead to a compromise of the device's integrity and potentially impact network traffic.

System commands on the router.
Remote unauthenticated command injection.
Network control and traffic interception.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical command injection vulnerability in TP-LINK TL-WR840N firmware impacts network edge devices, making infrastructure and network security teams the likely owners. The immediate priority is to locate all instances of the affected device, assess their network exposure and business criticality, and identify the accountable owner for remediation planning.

Infrastructure and security teams own this.
Verify device exposure and criticality first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the TP-LINK TL-WR840N router used for?

The TP-LINK TL-WR840N is a consumer-grade wireless router designed to serve as a network gateway. It provides internet connectivity for home or small office environments by routing traffic between the local network and the internet, while also managing Wi-Fi access for connected devices.

What does CWE-78 mean for CVE-2022-25060?

CVE-2022-25060 involves a weakness known as CWE-78, or OS Command Injection. This means the device fails to properly filter user-supplied input before passing it to the system's command processor. Because of this, an attacker can input malicious commands that the router mistakenly executes as if they were legitimate system instructions.

How is the oal_startPing component triggered?

The vulnerability is triggered when the router receives a specially crafted network request directed at the oal_startPing component. Simply using the device for standard web browsing or routine network traffic does not trigger this issue; the attacker must specifically target this component with malformed data to execute unauthorized commands.

Why does Halo Surface Signal categorize this as an external risk?

Halo Surface Signal flags this as an external risk because the TL-WR840N is a consumer edge device. Since these routers are typically positioned at the boundary between the internet and the internal network, management interfaces or specific components like oal_startPing are often reachable from the public internet, increasing the likelihood of unauthorized access.

Do I need to check my network for this router?

Yes. If your environment uses TP-LINK TL-WR840N devices, you should identify where they are deployed and who manages them. Once you have an inventory of these units, assess their network visibility. Since this flaw allows for unauthenticated command execution, restricting access to the router's management features is a critical first step while you plan for firmware updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.