External risk intelligence

TP-LINK TL-WR840N Command Injection via oal_setIp6DefaultRoute

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-25061

The vulnerability affects a consumer-grade wireless router. These devices are typically deployed as edge networking equipment, placing their management and routing interfaces in a position where they are often reachable from the local network and, depending on configuration, potentially exposed to the internet.

OS Command Injection

Tp Link Tl Wr840n Firmware

6.20_180709

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical command injection vulnerability has been identified in TP-LINK TL-WR840N devices. This issue allows for unauthorized execution of commands by an attacker, potentially impacting the device's network functions. The main concern is confirming relevance and exposure within our environment.

Allows unauthorized command execution on network devices.
High severity, affects common networking equipment.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network requests to the vulnerable device. This could allow them to inject and execute arbitrary commands on the router, potentially leading to a complete compromise of the device.

Unauthenticated network access required.
Vulnerable component accepts malicious input.
Leads to command execution and device compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject commands into the device's operating system through its network interface. When supported by the advisory, this could affect the router's core network functions and potentially expose sensitive information processed by the device.

System configuration and network traffic.
Remote unauthenticated command injection.
Compromised network services and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This command injection vulnerability in TP-LINK TL-WR840N firmware affects a consumer-grade wireless router. Typically, network infrastructure teams or dedicated IT operations manage such devices. The immediate first step is to inventory all instances of this hardware, assess their network exposure, and identify the owner responsible for managing the device. Once prioritized by risk, a remediation plan involving vendor coordination or firmware updates can be established.

Own the issue: Network Infrastructure/IT Operations.
Verify first: Device exposure and business criticality.
Action: Plan risk-based remediation strategy.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the TP-LINK TL-WR840N?

It is a consumer-grade wireless router used to provide network connectivity and manage internet traffic in homes or small offices. The affected firmware, version 180709, acts as the internal operating system that controls the router's hardware, routing protocols, and security settings.

What does command injection mean for CVE-2022-25061?

This vulnerability falls under the weakness class of CWE-78, which involves improper neutralization of special elements used in an OS command. In this case, the router fails to properly filter input in the oal_setIp6DefaultRoute component. This allows an attacker to insert and execute unauthorized system commands, potentially gaining full control over the router's operations.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending specifically crafted network requests to the vulnerable router. The vulnerability relies on the device accepting malicious input through its network interface. It does not require local physical access, nor does it require the attacker to be authenticated to the router's management console to initiate the attack.

Is my device at risk based on Halo Surface Signal?

The risk depends on your device's placement. Halo Surface Signal identifies this as a 'Likely' threat because routers are edge devices often reachable from local networks or directly exposed to the internet. If your router is configured to allow remote management or is placed at the network perimeter, it is in a position where external attackers could potentially reach the vulnerable component.

What should I do if I use this router?

Start by performing an inventory to locate all instances of this specific hardware model in your network. Assess each device to determine its current network exposure and connectivity. Once you have identified which routers are in use, prioritize them by risk and coordinate with your IT or network infrastructure team to manage the device, verify firmware status, and implement a remediation plan provided by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.