CVE-2018-25321
TP-Link TL-WR720N CSRF via Administrative Interfaces (firmware V1_130719)
- State
- Published
- Severity
- 5.3 Medium
- Published
- May 17, 2026
- Updated
- Oct 1, 2026
- Reserved
- May 17, 2026
Description
TP-Link TL-WR720N wireless router contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious web requests. Attackers can modify port forwarding rules via VirtualServerRpm.htm or change WiFi security settings via WlanSecurityRpm.htm by tricking authenticated users into visiting attacker-controlled pages.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N | VulnCheck |
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
TL-WR720NMbps Wireless N RouterTp-link |
|
References
- ExploitDB-44335exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: TP-Link TL-WR720N All Versions CSRF via Administrative Interfacesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.