Cross-site request forgery in TP-Link TL-WR720N enables unauthorized router administration

TP-Link TL-WR720N wireless router contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious web requests. Attackers can modify port forwarding rules via VirtualServerRpm.htm or change WiFi security settings via WlanSecurityRpm.htm by tricking authenticated users into visiting attacker-controlled pages.

• The CNA record identifies the TP-Link TL-WR720NMbps Wireless N Router with firmware V1_130719 as affected. • The NVD configuration describes firmware versions up to and including v1_130719. The normalized record does not provide a separate branch or release confirmed to be unaffected. • The public PoC describes the issue as applying to all versions, but the structured affected record confirms only V1_130719. The status of other branches remains unverified. • No fixed release is confirmed in the available evidence.

TP-Link TL-WR720N processes administrative configuration requests without adequately preventing a third-party web page from submitting requests on behalf of a user. The affected interfaces are VirtualServerRpm.htm and WlanSecurityRpm.htm, which handle port forwarding rules and WiFi security settings respectively. An attacker must cause a user with an authenticated administrative session to visit attacker-controlled content; the user's browser can then send requests to the router wherever it can reach the device. The public PoC targets private router addresses, so practical exploitability depends on browser reachability to the device. The available evidence does not describe the missing validation mechanism, such as a CSRF token or an origin-validation rule.

A public proof of concept is listed in Exploit-DB and demonstrates CSRF against the router's administrative interfaces. Exploitation requires a user with an authenticated administrative session to visit attacker-controlled web content. The PoC sends web requests toward private router addresses and the named administrative pages, so exploitation from outside the local network depends on whether the victim's browser can reach the router; the available evidence does not establish that these interfaces are exposed to the public Internet. The reviewed record confirms a public PoC, but it does not document a specific exploitation campaign or abuse event.

The flaw allows an attacker-controlled web page to submit configuration-changing requests to the administrative interface when the browser has a suitable authenticated session. The confirmed technical outcome is unauthorized modification of port forwarding rules or WiFi security settings, so the primary effect is loss of router configuration integrity. Such changes could expose internal services, disrupt connectivity, or enable unauthorized network access depending on the device configuration. The record does not establish data access, code execution, or escalation to higher privileges on the device.

• Unauthorized port forwarding changes could expose internal services or alter the path of network traffic. • Unauthorized WiFi security changes could disrupt connectivity, force user reconfiguration, or enable unauthorized wireless access depending on the settings changed. • Because the flaw affects administrative configuration integrity, operations teams may need to revalidate network, NAT, and WiFi settings after a suspected event. • The record does not establish data access, remote code execution, or operating-system compromise, so those outcomes should not be inferred from this entry.

1. Identify and address TP-Link TL-WR720N devices running firmware V1_130719 in the managed environment.
2. Do not assume that another firmware release fixes the issue unless TP-Link or the CNA confirms it; the available evidence does not name a fixed release.
3. Until a confirmed fix is available, restrict administrative access to necessary networks and avoid using router administration sessions while browsing untrusted content.
4. If the device no longer receives supported firmware, consider isolating or replacing it as a risk-reduction measure. This is an operational recommendation, not a vendor-confirmed patch.
5. After updating, changing, or replacing a device, recheck port forwarding rules and WiFi security settings for unauthorized changes that may remain.

1. Inventory TP-Link TL-WR720N devices and compare their installed firmware with the affected scope in this record.
2. Identify devices whose administrative interface can be reached from networks where users browse untrusted web content, with particular attention to VirtualServerRpm.htm and WlanSecurityRpm.htm.
3. Review configuration history, where available, for unplanned changes to port forwarding rules or WiFi security settings.
4. Review administrative request logs, if available, for unusual requests to the two named interfaces and correlate them with user visits to unrelated websites. This is a precautionary review, not a confirmed IOC.
5. Do not treat the absence of log entries or configuration changes as proof that a device is safe, because the record does not establish the product's complete logging coverage.