Home

Description

TP-Link TL-WR720N wireless router contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious web requests. Attackers can modify port forwarding rules via VirtualServerRpm.htm or change WiFi security settings via WlanSecurityRpm.htm by tricking authenticated users into visiting attacker-controlled pages.

PUBLISHED Reserved 2026-05-17 | Published 2026-05-17 | Updated 2026-05-18 | Assigner VulnCheck




MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
MEDIUM: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Problem types

Cross-Site Request Forgery (CSRF)

Product status

V1_130719
affected

Credits

Mans van Someren finder

References

www.exploit-db.com/exploits/44335 (ExploitDB-44335) exploit

www.tp-link.com/ (Official Product Homepage) product

static.tp-link.com/...urces/software/TL-WR720N_V1_130719.zip (Product Reference) product

www.vulncheck.com/...ions-csrf-via-administrative-interfaces (VulnCheck Advisory: TP-Link TL-WR720N All Versions CSRF via Administrative Interfaces) third-party-advisory

cve.org (CVE-2018-25321)

nvd.nist.gov (CVE-2018-25321)

Download JSON