Medium · published August 13, 2026
The web
interface of the affected
device relies on the HTTP referrer header as part of
request validation. Requests containing empty Referer value, or omitting
the Referer header entirely, may be accepted and processed due to insufficient
validation logic.
Successful exploitation may allow an adjacent attacker with access to the web management
interface to obtain device configuration details and other sensitive
information.
| Product | Versions | Fixed in |
|---|---|---|
| tp-link/tl-wr820n_firmware | < 1.15.20 | 1.15.20 |