CVE-2022-25061

What it actually does

The described flaw is an unauthenticated network-reachable command injection in TP-LINK TL-WR840N(ES) V6.20 firmware, specifically in the IPv6 default route handling component oal_setIp6DefaultRoute. If user-controlled route configuration data is passed to an operating-system command without proper validation or escaping, an attacker can append shell metacharacters and cause arbitrary commands to run on the device. With CVSS 9.8 and a network, low-complexity, no-authentication attack vector, successful exploitation can provide full confidentiality, integrity, and availability impact on the affected device, including command execution as the web management service user, and potentially root depending on firmware privilege model. The provided package metadata also lists moodle/moodle fixed at commit 84d3ae1b081ba764a54baf40ed063b96764c81c4, which appears inconsistent with the TP-LINK firmware description and should be verified before applying product-specific remediation.

Why it matters to the business

A vulnerable internet- or LAN-exposed router can be taken over remotely, allowing attackers to disrupt connectivity, change routing or DNS behavior, intercept or redirect traffic, install botnet malware, pivot into internal networks, or use the device as infrastructure for further attacks. The vulnerability is old, weaponized, and has a high EPSS score, which means exposed devices should be treated as likely to be scanned and targeted even though it is not currently listed in CISA KEV. Incorrect asset metadata increases operational risk because teams may patch the wrong product unless they validate whether the exposure is TP-LINK firmware, the listed Moodle source commit, or both.

How an attack unfolds

An attacker first identifies a reachable management interface on a TP-LINK TL-WR840N device running the affected firmware. They then interact with the IPv6 route configuration functionality that reaches oal_setIp6DefaultRoute and supply crafted input containing command separators or shell syntax where an IPv6 default route value is expected. Because the vulnerable firmware fails to safely constrain or escape that input before invoking an operating-system command, the injected command executes on the device. After code execution, the attacker commonly validates execution with a simple outbound callback, downloads a payload using built-in tools such as wget, curl, tftp, or busybox, changes device configuration, creates persistence where possible, joins the device to a botnet, or uses the compromised router to proxy traffic and attack internal systems.

How to fix it

Upgrade affected TP-LINK TL-WR840N firmware to a vendor-fixed release if available, or replace/end-of-life devices that cannot receive a security update. Disable WAN-side administrative access, restrict management access to a trusted management network, and block inbound access to router administration ports from untrusted networks. If the supplied source package metadata is relevant in your inventory, update moodle/moodle GIT deployments to a revision containing commit 84d3ae1b081ba764a54baf40ed063b96764c81c4 or later; however, because this fixed-version metadata conflicts with the TP-LINK firmware description, validate product applicability before treating that commit as the remediation for router firmware. As compensating controls, disable IPv6 route management features if unused, enforce ACLs around administrative interfaces, monitor outbound traffic from network devices, rotate any credentials stored on or traversing the device after suspected compromise, and factory-reset/reflash devices that show signs of exploitation.

How to confirm the fix worked

Confirm the exact device model and firmware build from the management interface, device label, configuration export, or authenticated CLI where available, and compare it against TL-WR840N(ES)_V6.20_180709 and vendor fixed firmware advisories. Verify that administrative interfaces are not reachable from the internet and are restricted to authorized management networks. After patching, retest the IPv6 default route configuration path with benign validation strings containing shell metacharacters and confirm they are rejected, encoded, or treated only as data and do not produce command execution or outbound callbacks. For source-controlled assets matching the supplied package metadata, verify the deployed commit includes 84d3ae1b081ba764a54baf40ed063b96764c81c4 or a later trusted revision. Validate network controls by externally scanning for exposed management ports and internally checking that router egress is limited to expected destinations.

Typical attack path

1. Scan the internet or local network for exposed TP-LINK TL-WR840N management interfaces or fingerprintable firmware banners.
2. Confirm the device model and firmware version are consistent with TL-WR840N(ES)_V6.20_180709 or another build containing the vulnerable oal_setIp6DefaultRoute code path.
3. Send a crafted request to the IPv6 default route configuration functionality containing shell-control characters in a route-related parameter.
4. Trigger backend route-setting logic so the injected shell command is interpreted by the firmware operating system.
5. Establish proof of execution through DNS, HTTP, ICMP, or another outbound callback from the router.
6. Download and execute follow-on tooling, often from /tmp or another writable embedded Linux filesystem location.
7. Modify router configuration, implant persistence if supported, pivot into the internal network, or enroll the device into scanning, proxy, DDoS, or credential-theft infrastructure.

How to detect it

Investigate whether the router management interface received suspicious HTTP requests targeting IPv6 route or default route configuration immediately before unusual outbound activity from the device. Useful log sources include firewall logs, reverse proxy logs if the interface is proxied, web administration logs if available, IDS/IPS alerts, DNS resolver logs, NetFlow, DHCP lease history, device syslog, and configuration-change audit logs. Look for shell metacharacters or command execution syntax in request parameters, including semicolons, pipes, backticks, $(), redirection operators, encoded equivalents, and references to common embedded Linux utilities such as wget, curl, tftp, nc, telnet, busybox, sh, chmod, or crontab. Correlate suspicious administration requests with outbound DNS/HTTP/TFTP connections from the router, creation or execution of files under /tmp, unexpected changes to DNS, default route, port forwarding, remote management, VPN, or firewall settings, and traffic patterns consistent with scanning, proxying, or DDoS participation. If logs are sparse, compare current firmware hashes/configuration against a known-good baseline and inspect for unknown startup scripts, cron entries, added users, altered admin credentials, or unexplained processes.

• oal_setIp6DefaultRoute
• TL-WR840N(ES)_V6.20_180709
• ip -6 route add default
• route -A inet6 add default
• wget http://
• curl http://
• tftp -g
• busybox wget
• chmod +x /tmp/
• /tmp/busybox
• /tmp/.busybox
• /tmp/mips
• /tmp/mipsel
• /tmp/arm
• /tmp/bot
• sh -c
• /bin/sh -c
• `wget
• $(wget
• ;wget
• |wget
• ;curl
• |curl
• ;tftp
• |tftp
• nc -e
• telnetd
• crontab -e
• /var/spool/cron
• /etc/init.d/
• /etc/rc.local

What your security team should do

• Prioritize internet-exposed or untrusted-network-exposed TP-LINK TL-WR840N devices for immediate isolation, firmware upgrade, replacement, or management-interface lockdown because exploitation is weaponized and EPSS is high.
• Perform an asset-data quality check: reconcile the TP-LINK firmware description against the supplied moodle/moodle fixed-version metadata before closing remediation tasks.
• Search perimeter telemetry for router administration interfaces exposed to the internet and remove exposure wherever possible.
• Review DNS, proxy, firewall, and NetFlow logs for unusual outbound connections originating from routers or embedded network devices, especially to unknown IPs shortly after administrative HTTP requests.
• If exploitation is suspected, treat the device as compromised: preserve logs/configuration where feasible, reflash firmware from a trusted image or replace the device, reset configuration from known-good backups, and rotate administrative, Wi-Fi, VPN, ISP, and downstream credentials that may have been exposed.
• Add SIEM detections for command-injection patterns in router management requests, including shell metacharacters, command substitution, and downloader utilities in HTTP parameters.
• Segment network infrastructure management planes from user networks and prohibit direct internet access to embedded device administration interfaces.
• Continuously monitor for firmware versions known to be unsupported or end-of-life and plan hardware refresh where patches are unavailable.