CVE-2022-25064 – This vulnerability allows remote attackers to e... (How to Fix)

Q: What is the severity of CVE-2022-25064?

CVE-2022-25064 has a CVSS score of 9.8 (CRITICAL). This vulnerability allows remote attackers to execute arbitrary code on TP-LINK TL-WR840N routers via a crafted IPv6 address payload in the oal_wan6_setIpAddr function. Attackers can gain full control of affected routers without authentication. All users of TP-LINK TL-WR840N(ES) V6.20 firmware version 180709 are affected.

📋 TL;DR

This vulnerability allows remote attackers to execute arbitrary code on TP-LINK TL-WR840N routers via a crafted IPv6 address payload in the oal_wan6_setIpAddr function. Attackers can gain full control of affected routers without authentication. All users of TP-LINK TL-WR840N(ES) V6.20 firmware version 180709 are affected.

💻 Affected Systems

Products:

TP-LINK TL-WR840N
TP-LINK TL-WR840N(ES)

Versions: V6.20 firmware version 180709

Operating Systems: Embedded router firmware

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability exists in default IPv6 configuration. All devices with this firmware version are vulnerable.

📦 What is this software?

Tl Wr840n Firmware by Tp Link

View all CVEs affecting Tl Wr840n Firmware →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete router compromise allowing attackers to intercept all network traffic, install persistent malware, pivot to internal networks, and use the router as a botnet node.

🟠

Likely Case

Router takeover leading to DNS hijacking, credential theft from network traffic, and deployment of malicious firmware.

🟢

If Mitigated

Limited impact if routers are behind firewalls with strict IPv6 filtering and network segmentation.

🌐 Internet-Facing: HIGH - Routers are typically internet-facing devices directly accessible from WAN interfaces.

🏢 Internal Only: MEDIUM - Internal exploitation possible if attacker gains internal network access first.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploit requires sending crafted IPv6 payload to vulnerable function. Public references suggest working exploit details are available.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check TP-LINK for latest firmware updates

Vendor Advisory: http://tp-link.com

Restart Required: Yes

Instructions:

1. Log into router admin interface. 2. Navigate to System Tools > Firmware Upgrade. 3. Download latest firmware from TP-LINK support site. 4. Upload and install firmware. 5. Reboot router.

🔧 Temporary Workarounds

Disable IPv6

all

Disable IPv6 functionality on the router to prevent exploitation via the vulnerable function.

Log into router admin > Network > IPv6 > Disable IPv6

Restrict WAN Access

all

Configure firewall rules to restrict access to router management interface from WAN.

Log into router admin > Security > Firewall > Enable SPI Firewall
Set Access Control to restrict WAN management

🧯 If You Can't Patch

Isolate vulnerable routers in separate network segment with strict firewall rules
Implement network monitoring for suspicious IPv6 traffic patterns

🔍 How to Verify

Check if Vulnerable:

Check router firmware version in admin interface: System Tools > Firmware Version. If version is V6.20 180709, device is vulnerable.

Check Version:

Log into router web interface and navigate to System Tools > Firmware Version

Verify Fix Applied:

After firmware update, verify version has changed from V6.20 180709 to newer version. Test IPv6 functionality to ensure router operates normally.

📡 Detection & Monitoring

Log Indicators:

Unusual IPv6 configuration changes
Multiple failed login attempts followed by successful access
Unexpected firmware modification logs

Network Indicators:

Unusual outbound connections from router
DNS queries to suspicious domains
Unexpected IPv6 traffic patterns

SIEM Query:

source="router_logs" AND ("oal_wan6_setIpAddr" OR "IPv6 configuration" OR "firmware") AND severity=HIGH

📊 Metadata

CVE ID: CVE-2022-25064

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-78

Published: February 25, 2022

Last Updated: November 21, 2024

🔗 References

http://router.com Not Applicable,URL Repurposed
http://tp-link.com Product
https://east-trowel-102.notion.site/CVE-2021-XXXX-rce-via-crafted-payload-in-an-ipv6-address-input-field-hidden-EN-98e24b6f841043fba17ec4627c34f5d1 Exploit,Third Party Advisory
http://router.com Not Applicable,URL Repurposed
http://tp-link.com Product
https://east-trowel-102.notion.site/CVE-2021-XXXX-rce-via-crafted-payload-in-an-ipv6-address-input-field-hidden-EN-98e24b6f841043fba17ec4627c34f5d1 Exploit,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-25064, you might also want to check these: