CVE-2018-11714

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.09.8Critical EPSS percentile99th67% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixNone yetNo fix or workaround published

Published 2018-06-04Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your TP-Link router model is TL-WR840N or TL-WR841N, and confirm the exact firmware version/build shown on the router’s admin page.
If your firmware matches the affected versions (listed in the TL-WR840N/TL-WR841N entries for CVE-2018-11714), treat the router as vulnerable.
Do not expose the router’s admin interface to the internet (remove/avoid port forwarding, UPnP, and any remote-administration features).
Restrict access to the router admin interface to only trusted internal devices (or place the router behind a firewall that blocks access from untrusted networks).
If no vendor patch exists for your specific firmware, plan to replace the router or upgrade to a firmware version known to not be in the affected set—coordinate with TP-Link support or your vendor—then recheck the firmware version after the upgrade.

May need vendor or contractor work

Check it yourselfA free Nuclei check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n devices. This issue is caused by improper session handling on the /cgi/ folder or a /cgi file. If an attacker sends a header of "Referer: http://192.168.0.1/mainFrame.htm" then no authentication is required for any action.

In plain language

Written by AI from the record

This vulnerability in some older TP-Link TL-WR840N and TL-WR841N router firmware can let an attacker perform actions without logging in, if they can reach the router’s web interface. A typical small business should treat this as a real risk and plan to replace or isolate the affected router firmware, because no official fix is listed.

Improper session handling in TP-Link’s web CGI components (CWE-384) on TL-WR840N firmware and TL-WR841N firmware can be abused to bypass authentication by sending a crafted Referer header to /cgi/ endpoints, enabling unauthorized actions without prior login.

If you're affected

Unauthorized router configuration changes
Network disruption
Possible data interception risk
Increased likelihood of follow-on attacks

What is it

It’s a flaw in the router’s website/admin functionality where the router may “trust” a session incorrectly. If an attacker can reach the router and sends a specific kind of browser header, the router can treat the attacker like they’re logged in.

Think of it like a door that sometimes thinks a fake key is real—so someone can enter and change things inside the router.

Who is affected

This matters if your business uses a TP-Link TL-WR840N or TL-WR841N router running one of the specifically affected firmware versions/builds listed for CVE-2018-11714. If you can reach the router’s web admin functions from a place an attacker could access (for example, the internet, or an untrusted network inside your environment), you’re at risk.

A practical rule: it’s mainly a concern when the router’s web interface is reachable by an attacker (not just when the router exists on your network).

How urgent is it

This should be treated as an urgent, real-world risk because there is a public exploit available and the likelihood is trending upward. Even though it’s not listed in CISA KEV, the combination of public exploit and an authentication bypass means attackers can potentially act quickly if they can reach the router.

What to do — in detail

Confirm exposure

In your router’s admin interface, find the firmware version/build (often under “System” or “Firmware”).
Check whether your router matches either of the affected entries for CVE-2018-11714:
- TL-WR840N v5 with the listed firmware/build identifiers
- TL-WR841N v13 with the listed firmware/build identifiers
If you cannot find the exact match, still collect: model, hardware version, and full firmware string so the vendor/IT team can verify whether it’s in scope.

Reduce the risk immediately (workarounds)

Ensure the router’s admin/web interface is not reachable from the internet:
- Remove any port-forwarding rules for the admin interface
- Disable remote administration if enabled
- Disable UPnP if it may open access unintentionally
Restrict access from inside your network:
- If possible, allow access to the router admin interface only from specific trusted internal devices
- Block access from guest Wi‑Fi/VLANs/untrusted segments (or route through a firewall policy that denies access to the router’s admin ports)

Upgrade / replacement

The sources available here state no fix/patch information is available for this CVE. That means:
- If your firmware is affected, you should contact TP-Link support (or your router vendor) with your exact firmware string and ask for a non-affected upgrade path.
- If there is no upgrade available for your hardware/firmware line, plan a router replacement with a model/firmware that is not in the affected set.
After any upgrade, repeat Step 2 to verify the firmware is no longer on the affected versions/builds.

What to monitor

Look for signs of unauthorized configuration changes (new DNS settings, changed admin password, changed wireless settings, unexpected reboots).
Review router logs if available for repeated requests to web/CGI endpoints from unexpected sources, especially around the time changes occurred.

Due date

No KEV due date was provided because this CVE is not listed in CISA KEV in the findings.

Technical context

CVE-2018-11714 is a vulnerability affecting specified TP-Link router firmware versions (TL-WR840N firmware and TL-WR841N firmware) with weakness type CWE-384 (session handling issues). The findings indicate public exploit availability (weaponized exploit exists) and no fix/patch information is available in the provided sources.

Attack mechanism described in the findings: improper session handling on /cgi/ folder or a /cgi file, where an attacker can bypass authentication by sending a crafted header: "Referer: http://192.168.0.1/mainFrame.htm". This can allow unauthorized actions without authentication.

Exploit status/maturity: public exploit available (at least one known). KEV: not listed in CISA KEV. EPSS is provided as a prediction and is rising, but the findings do not show KEV confirmation; therefore, treat this as risk-based urgency driven by the presence of a public exploit rather than KEV status.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

67% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

28 events over 3033 days, from the signal feeds we watch.

2026-09-23EPSS band changemoderate → highepss band change
2026-09-21EPSS band changehigh → moderateepss band change
2026-09-06EPSS band changemoderate → highepss band change
2026-09-05EPSS band changehigh → moderateepss band change
2026-08-31EPSS band changemoderate → highepss band change
2026-08-29EPSS band changehigh → moderate

Affected products

tp-linkcommercial · TWaka tp link
- tl-wr840n firmwareNetworking Infrastructure
- tl-wr841n firmwareNetworking Infrastructure

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable