CVE-2018-11714

It’s a flaw in the router’s website/admin functionality where the router may “trust” a session incorrectly. If an attacker can reach the router and sends a specific kind of browser header, the router can treat the attacker like they’re logged in.

Think of it like a door that sometimes thinks a fake key is real—so someone can enter and change things inside the router.

This matters if your business uses a TP-Link TL-WR840N or TL-WR841N router running one of the specifically affected firmware versions/builds listed for CVE-2018-11714. If you can reach the router’s web admin functions from a place an attacker could access (for example, the internet, or an untrusted network inside your environment), you’re at risk.

A practical rule: it’s mainly a concern when the router’s web interface is reachable by an attacker (not just when the router exists on your network).

This should be treated as an urgent, real-world risk because there is a public exploit available and the likelihood is trending upward. Even though it’s not listed in CISA KEV, the combination of public exploit and an authentication bypass means attackers can potentially act quickly if they can reach the router.