CVE-2026-15141
Full vulnerability record from the local CVENow database.
Description
The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficient validation logic. Successful exploitation may allow an adjacent attacker with access to the web management interface to obtain device configuration details and other sensitive information.
Severity
MEDIUM
CVSS score
5.3
(v4.0)
Vulnerability status
Analyzed
Source identifier
f23511db-6c3e-4e32-a477-6aa17d310630
Published
2026-08-12 23:17:19.703000
Last modified
2026-10-23 19:10:00.167000
View original CVE JSON
{
"id": "CVE-2026-15141",
"sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630",
"published": "2026-08-12T23:17:19.703",
"lastModified": "2026-10-23T19:10:00.167",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The web\ninterface of the affected\ndevice relies on the HTTP referrer header as part of\nrequest validation. Requests containing empty Referer value, or omitting\nthe Referer header entirely, may be accepted and processed due to insufficient\nvalidation logic.\n\n\n\n\n\nSuccessful exploitation may allow an adjacent attacker with access to the web management\ninterface to obtain device configuration details and other sensitive\ninformation."
},
{
"lang": "es",
"value": "La interfaz web del dispositivo afectado se basa en el encabezado HTTP Referer como parte de la validación de solicitudes. Las solicitudes que contienen un valor Referer vacío, o que omiten el encabezado Referer por completo, pueden ser aceptadas y procesadas debido a una lógica de validación insuficiente.\n\nUna explotación exitosa puede permitir a un atacante adyacente con acceso a la interfaz de gestión web obtener detalles de configuración del dispositivo y otra información sensible."
}
],
"affected": [
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"affectedData": [
{
"vendor": "TP-Link Systems Inc.",
"product": "TL-WR820N v2",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "1.15.20 Build 260611 Rel.29552n",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "ADJACENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.1,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-13T13:11:43.168498Z",
"id": "CVE-2026-15141",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-346"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:tp-link:tl-wr820n_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.15.20",
"matchCriteriaId": "B2CE2B0A-5835-4395-B3A3-64D7DC436EC6"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:tp-link:tl-wr820n:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "BB08E9FF-0EFD-49C0-97D3-B6313DF7E673"
}
]
}
]
}
],
"references": [
{
"url": "https://www.tp-link.com/en/support/download/tl-wr820n/#Firmware",
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Product"
]
},
{
"url": "https://www.tp-link.com/en/support/faq/5243/",
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.tp-link.com/kr/support/download/tl-wr820n/#Firmware",
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Product"
]
}
]
}