What’s Vulnerable › Vulnerabilities

CVE-2025-14738: Configuration Disclosure Vulnerability in TP-Link WA850RE

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-18 · updated 2026-06-17
• Weakness: CWE-287

Description

Improper authentication vulnerability in TP-Link WA850RE (httpd modules) allows unauthenticated attackers to download the configuration file.This issue affects: ≤ WA850RE V2_160527, ≤ WA850RE V3_160922.

Affected products

• TP-Link Systems Inc. WA850RE: through 160527; through 160922

References

• https://blog.exodusintel.com/2022/06/23/tp-link-wa850re-unauthenticated-configuration-disclosure-vulnerability/
• https://www.tp-link.com/us/support/download/tl-wa850re/v2/#Firmware
• https://www.tp-link.com/us/support/download/tl-wa850re/v3/#Firmware
• https://www.tp-link.com/us/support/faq/4848/

Get alerted when CVE-2025-14738 or the next vulnerability affects your stack