CVE-2020-14965

Name of the Vulnerable Software and Affected Versions TP-Link TL-WR740N version 4 TP-Link TL-WR740ND version 4

Description The issue allows an attacker with access to the admin panel to inject HTML code, altering the HTML context of target pages and stations in access-control settings. This can be achieved via targets lists name or hosts lists name. Additionally, the issue can be exploited through a CSRF, which does not require administrator authentication.

Recommendations For TP-Link TL-WR740N version 4, consider restricting access to the admin panel to prevent unauthorized changes. For TP-Link TL-WR740ND version 4, avoid using the targets lists name and hosts lists name parameters in the access-control settings until the issue is resolved.