{"id":"CVE-2022-25060","title":"TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_startPing.","summary":"TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_startPing.","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-78"],"vendor":"tp-link","product":"tl-wr840n_firmware","affected":["tl-wr840n_firmware = 6.20_180709"],"published":"2022-02-25","updated":"2026-07-05","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-25060","references":[{"url":"https://east-trowel-102.notion.site/CVE-2021-XXXX-Injection-of-commands-through-object-oal_startPing-EN-939c748c5f244504899477114b1ca1cf","label":"cve@mitre.org"},{"url":"http://router.com","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://tp-link.com","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://east-trowel-102.notion.site/CVE-2021-XXXX-Injection-of-commands-through-object-oal_startPing-EN-939c748c5f244504899477114b1ca1cf","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","in-the-wild","exploit-available"],"epss":0.4015,"epssPercentile":0.98571,"ingestedAt":"2026-07-06T02:09:23.216Z","exploited":true,"exploits":{"github":1,"githubRepos":["https://github.com/exploitwritter/CVE-2022-25060"],"checkedAt":"2026-09-23T07:13:22.908Z"},"exploitAvailable":true,"slug":"CVE-2022-25060","body":"## Overview\n\nTP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_startPing.\n\n## Affected\n\n- `tl-wr840n_firmware = 6.20_180709`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":80,"depthScoreParts":{"impact":53.9,"likelihood":8,"exploitation":18,"ransomware":0},"changes":[{"seq":4600,"id":"CVE-2022-25060","ts":1788887193645,"field":"exploit_available","old":"false","new":"true"},{"seq":3483,"id":"CVE-2022-25060","ts":1788886310060,"field":"exploit_available","old":"true","new":"false"},{"seq":2337,"id":"CVE-2022-25060","ts":1788882979578,"field":"exploit_available","old":"false","new":"true"},{"seq":1366,"id":"CVE-2022-25060","ts":1788882392163,"field":"exploit_available","old":"true","new":"false"},{"seq":480,"id":"CVE-2022-25060","ts":1788881827789,"field":"exploit_available","old":"false","new":"true"},{"seq":79,"id":"CVE-2022-25060","ts":1784920441388,"field":"epss","old":"0.48182","new":"0.39888"},{"seq":13,"id":"CVE-2022-25060","ts":1783374350583,"field":"exploited","old":"false","new":"true"},{"seq":12,"id":"CVE-2022-25060","ts":1783370799010,"field":"exploited","old":"true","new":"false"},{"seq":11,"id":"CVE-2022-25060","ts":1783370770217,"field":"exploited","old":"false","new":"true"},{"seq":10,"id":"CVE-2022-25060","ts":1783367195651,"field":"exploited","old":"true","new":"false"},{"seq":9,"id":"CVE-2022-25060","ts":1783367144601,"field":"exploited","old":"false","new":"true"},{"seq":8,"id":"CVE-2022-25060","ts":1783363592145,"field":"exploited","old":"true","new":"false"},{"seq":7,"id":"CVE-2022-25060","ts":1783363518865,"field":"exploited","old":"false","new":"true"},{"seq":6,"id":"CVE-2022-25060","ts":1783359988731,"field":"exploited","old":"true","new":"false"},{"seq":5,"id":"CVE-2022-25060","ts":1783357401521,"field":"exploited","old":"false","new":"true"},{"seq":4,"id":"CVE-2022-25060","ts":1783356385706,"field":"exploited","old":"true","new":"false"},{"seq":3,"id":"CVE-2022-25060","ts":1783356272333,"field":"exploited","old":"false","new":"true"},{"seq":2,"id":"CVE-2022-25060","ts":1783352782674,"field":"exploited","old":"true","new":"false"},{"seq":1,"id":"CVE-2022-25060","ts":1783349367133,"field":"exploited","old":"false","new":"true"}]}