PT-2025-16881 · Tp Link · Tp-Link Tl-Wr840N

Theveteran1 · Published 2025-04-10 · Updated 2025-04-24 · CVE-2025-29649

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TP-Link TL-WR840N router version 1.0

Description A SQL Injection vulnerability exists in the TP-Link TL-WR840N router's login dashboard, allowing an unauthenticated attacker to inject malicious SQL statements via the username and password fields. This issue is disputed because it can only be reproduced on a supplier-provided emulator, where access control is intentionally absent for ease of functional testing.

Recommendations For version 1.0, consider disabling the login dashboard functionality until a patch is available. Restrict access to the login dashboard to minimize the risk of exploitation. Avoid using the username and password fields in the login dashboard until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-05221

CVE-2025-29649

Affected Products

Tp-Link Tl-Wr840N

References · 11

• 🔥 https://github.com/TheVeteran1/Vulnerability-Research/blob/main/CVE-2025-29649 · Exploit
• https://bdu.fstec.ru/vul/2025-05221 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-29649 · Security Note
• https://twitter.com/CVEnew/status/1913823764627726385 · Twitter Post
• https://t.me/cvedetector/23186 · Telegram Post
• https://t.me/cvenotify/119644 · Telegram Post
• https://twitter.com/cybercronai/status/1912880102322340304 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1912731078554460171 · Twitter Post
• https://t.me/cvenotify/119617 · Telegram Post
• https://twitter.com/dailycve/status/1915409243592646667 · Twitter Post
• https://t.me/cvetracker/21794 · Telegram Post