CVE-2022-25061: TP-Link TL-WR840N router command injection in oal_setIp6DefaultRoute

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication and no user interaction, combined with a public exploit reference and very high EPSS, makes this an urgent patch target.

What it is

The TP-Link TL-WR840N(ES) V6.20 firmware (build 180709) contains an OS command injection flaw in the oal_setIp6DefaultRoute component. Because the flaw is remotely reachable without authentication, it exposes the router to full compromise by anyone who can reach the interface.

Impact

An attacker can execute arbitrary OS commands on the device, gaining full control over confidentiality, integrity and availability of the router.

Attack surface

Reached over the network via the oal_setIp6DefaultRoute component; the CVSS vector indicates no privileges and no user interaction are required, so the request can be sent directly to the exposed interface.

Exploitation

A public exploit reference is tagged for this issue, and EPSS is high (0.587, ~99th percentile), though it is not listed in CISA KEV and no ransomware use is documented.

What to do

• Apply the vendor firmware update for TL-WR840N(ES) V6.20 or later as soon as it is available.
• If no patch exists, restrict management and IPv6-related interfaces to trusted networks and disable remote administration.
• Segment or isolate the router from untrusted networks and place it behind a firewall that blocks inbound access to its web/management ports.
• Monitor TP-Link advisories for a fixed firmware build and replace the device if support has ended.

Detection

• Inspect router and upstream logs for unexpected or malformed requests to the oal_setIp6DefaultRoute handler or IPv6 default route configuration endpoints.
• Alert on outbound connections or DNS lookups originating from the router to unknown hosts, which may indicate injected command callbacks.
• Check for unexpected processes, files or configuration changes on the device via its management interface or serial console.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.