Technical impact
The vulnerability is a command injection flaw (CWE-78) in the router configuration import function of TP‑Link TL‑WR802N v4, TL‑WR841N v14, and TL‑WR840N v6. An authenticated attacker who can log into the administrative interface can upload a specially crafted configuration file that is processed during port‑trigger handling. This causes the device to execute arbitrary OS commands with root privileges, leading to full device compromise.
Affected Systems
The affected products are TP‑Link TL‑WR802N firmware v4, TP‑Link TL‑WR841N firmware v14, and TP‑Link TL‑WR840N firmware v6. These models are specifically listed in the vendor’s advisory and correspond to the relevant firmware product identifiers.
Risk and Exploitability
The CVSS score of 8.5 indicates a high severity level. The EPSS score of 3% suggests that the likelihood of exploitation in the near term is low, and the vulnerability is not yet cataloged in the CISA KEV list. However, because the flaw requires only an authenticated session, any user or attacker who has gained administrative access could exploit the vulnerability. Full root‑level execution on the router vastly increases the potential damage and therefore represents a high‑risk condition that should prompt prompt remediation.
