A cross‑site request forgery flaw in TP‑Link TL‑WR720N routers lets an attacker forge administrative requests to alter network settings such as port forwarding rules and Wi‑Fi security options. By tricking a user who is already logged into the router, the attacker can modify the router’s configuration without permission, potentially redirecting traffic, exposing devices, or disabling wireless protection. The primary impact is breakdown of integrity and availability of the local network, as the attacker gains the ability to reconfigure key router functions.

All versions of the TP‑Link TL‑WR720N wireless N router are affected.

The CVSS score of 5.3 indicates a medium severity impact, and EPSS data is not available, so the likelihood of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a victim to be logged into the router’s web interface and to visit a malicious page crafted by the attacker; the attack vector is therefore web‑based and depends on social‑engineering of an authenticated user.