Read the docs

TP-Link

Records637All Threatist records
Exploited (KEV)6In CISA KEV
CVSS critical100CVSS 9.0–10.0
CVSS high356CVSS 7.0–8.9

Exploited now

TP-Link records in CISA KEV
TI-2023-27456 TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability Priority CRITICAL 86KEV 2025-09-03TI-2025-08589 TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability Priority CRITICAL 96KEV 2025-09-03TI-2020-14907 TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability Priority CRITICAL 97KEV 2025-09-02TI-2023-16571 TP-Link Multiple Routers Command Injection Vulnerability Priority CRITICAL 97KEV 2025-06-16TI-2023-01313 TP-Link Archer AX-21 Command Injection Vulnerability Priority CRITICAL 97KEV 2023-05-01TI-2015-02672 TP-Link Multiple Archer Devices Directory Traversal Vulnerability Priority CRITICAL 90KEV 2022-03-25

Components

Products in the NVD configurations · select one to filter the records
Tl-wr841n Firmware 39 records CRITICAL Tl-wr886n Firmware 39 records MEDIUM Er5110g Firmware 25 records LOW Er5120g Firmware 25 records LOW Er5510g Firmware 25 records LOW Er5520g Firmware 25 records LOW R4149g Firmware 25 records LOW R4239g Firmware 25 records LOW

Records

8 records in Er605 Firmware · all components

TI-2026-15915 CVE-2026-19586 · GHSA-32hp-8pjq-2c8g

Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways

Priority MEDIUM 57

A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection es…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.05724 Published 2026-08-20 Fixed in 2.4.3 Build 20260722 Rel.40250, 2.4.4 Build 20260630 Rel.14398 +17 CWE-78
TI-2025-05942 CVE-2025-6542 · GHSA-v223-4hv2-g25q

OS command injection in multiple parameters

Priority MEDIUM 50

An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01015 Published 2025-10-21 Fixed in ER8411 1.3.3, ER7412-M2 1.1.0 +11 CWE-78
TI-2025-07174 CVE-2025-7850 · GHSA-5r6g-vjqj-7mwg

Authenticated OS command execution in TP-Link Omada gateways

Priority MEDIUM 48

A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.

CVSS 4.0CRITICAL 9.3 Adjacent network High privileges No interaction EPSS 0.03308 Published 2025-10-21 Fixed in ER8411 1.3.3, ER7412-M2 1.1.0 +11 CWE-78
TI-2025-07175 CVE-2025-7851 · GHSA-q2rh-fc48-r3gw

Unauthorized root access via debug functionality

Priority MEDIUM 41

An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.

CVSS 4.0HIGH 8.7 Adjacent network High privileges No interaction EPSS 0.00674 Published 2025-10-21 Fixed in ER8411 1.3.3, ER7412-M2 1.1.0 +11 CWE-269
TI-2026-07940 CVE-2026-9033 · GHSA-fpm4-hq62-cqf6

Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways

Priority LOW 27

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions…

CVSS 4.0MEDIUM 6.0 Adjacent network No auth No interaction EPSS 0.00277 Published 2026-08-20 Fixed in 2.4.3 Build 20260722 Rel.40250, 2.4.4 Build 20260630 Rel.14398 +17 CWE-306
TI-2025-08515 CVE-2025-9290 · GHSA-gwgw-6q3h-28pg

Authentication Weakness on Omada Controllers, Gateways and Access Points

Priority LOW 26

An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values.

CVSS 4.0MEDIUM 6.0 Adjacent network No auth No interaction EPSS 0.00222 Published 2026-01-22 Fixed in 6.0.0.24, 6.0.0.100 +27 CWE-760
Open these records in search →