Read the docs
TI-2025-05941 Aliases CVE-2025-6541GHSA-x52x-mhfj-w7qq

OS command injection using information obtained from the web management interface

Priority MEDIUM 46CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

An arbitrary OS command may be executed on the product by the user who can log in to the web management interface.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00685 52nd percentileScored 2026-11-07
Fix Fixed Omada gateways (TP-Link Systems Inc.): ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1 +5Festa gateways (TP-Link Systems Inc.): FR365 1.1.10, FR205 1.0.3, FR307 1.2.5+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkOmada gatewaysbefore ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3Patch availableCNA
TP-LinkFesta gatewaysbefore FR365 1.1.10, FR205 1.0.3, FR307 1.2.5FR365 1.1.10, FR205 1.0.3, FR307 1.2.5Patch availableCNA
TP-LinkOmada Pro gatewaysbefore G36 1.1.4, G611 1.2.2G36 1.1.4, G611 1.2.2Patch availableCNA
  • Omada gateways VendorTP-Link Affected before ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3 Fixed in ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3 Patch available CNA
  • Festa gateways VendorTP-Link Affected before FR365 1.1.10, FR205 1.0.3, FR307 1.2.5 Fixed in FR365 1.1.10, FR205 1.0.3, FR307 1.2.5 Patch available CNA
  • Omada Pro gateways VendorTP-Link Affected before G36 1.1.4, G611 1.2.2 Fixed in G36 1.1.4, G611 1.2.2 Patch available CNA

CPE configurations NVD · 39

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:er706w_firmware:*:*:*:*:*:*:*:*before 1.2.1VulnerableTP-Link
cpe:2.3:o:tp-link:er706w_firmware:1.2.1:-:*:*:*:*:*:*1.2.1VulnerableTP-Link
cpe:2.3:h:tp-link:er706w:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:*before 1.2.1VulnerableTP-Link
cpe:2.3:o:tp-link:er706w-4g_firmware:1.2.1:-:*:*:*:*:*:*1.2.1VulnerableTP-Link
cpe:2.3:h:tp-link:er706w-4g:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er7212pc_firmware:*:*:*:*:*:*:*:*before 2.1.3VulnerableTP-Link
cpe:2.3:o:tp-link:er7212pc_firmware:2.1.3:-:*:*:*:*:*:*2.1.3VulnerableTP-Link
cpe:2.3:h:tp-link:er7212pc:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:g36_firmware:*:*:*:*:*:*:*:*before 1.1.4VulnerableTP-Link
  • cpe:2.3:o:tp-link:er706w_firmware:*:*:*:*:*:*:*:* Versions before 1.2.1 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:er706w_firmware:1.2.1:-:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er706w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:* Versions before 1.2.1 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:er706w-4g_firmware:1.2.1:-:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er706w-4g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er7212pc_firmware:*:*:*:*:*:*:*:* Versions before 2.1.3 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:er7212pc_firmware:2.1.3:-:*:*:*:*:*:* Versions 2.1.3 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er7212pc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:g36_firmware:*:*:*:*:*:*:*:* Versions before 1.1.4 Vulnerable ·TP-Link
Show 29 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:tp-link:g36_firmware:1.1.4:-:*:*:*:*:*:*1.1.4VulnerableTP-Link
cpe:2.3:h:tp-link:g36:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:g611_firmware:*:*:*:*:*:*:*:*before 1.2.2VulnerableTP-Link
cpe:2.3:o:tp-link:g611_firmware:1.2.2:-:*:*:*:*:*:*1.2.2VulnerableTP-Link
cpe:2.3:h:tp-link:g611:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:fr365_firmware:*:*:*:*:*:*:*:*before 1.1.10VulnerableTP-Link
cpe:2.3:o:tp-link:fr365_firmware:1.1.10:-:*:*:*:*:*:*1.1.10VulnerableTP-Link
cpe:2.3:h:tp-link:fr365:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:fr205_firmware:*:*:*:*:*:*:*:*before 1.0.3VulnerableTP-Link
cpe:2.3:o:tp-link:fr205_firmware:1.0.3:-:*:*:*:*:*:*1.0.3VulnerableTP-Link
cpe:2.3:h:tp-link:fr205:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:fr307-m2_firmware:*:*:*:*:*:*:*:*before 1.2.5VulnerableTP-Link
cpe:2.3:o:tp-link:fr307-m2_firmware:1.2.5:-:*:*:*:*:*:*1.2.5VulnerableTP-Link
cpe:2.3:h:tp-link:fr307-m2:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er8411_firmware:*:*:*:*:*:*:*:*before 1.3.3VulnerableTP-Link
cpe:2.3:o:tp-link:er8411_firmware:1.3.3:-:*:*:*:*:*:*1.3.3VulnerableTP-Link
cpe:2.3:h:tp-link:er8411:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er7412-m2_firmware:*:*:*:*:*:*:*:*before 1.1.0VulnerableTP-Link
cpe:2.3:o:tp-link:er7412-m2_firmware:1.1.0:-:*:*:*:*:*:*1.1.0VulnerableTP-Link
cpe:2.3:h:tp-link:er7412-m2:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er707-m2_firmware:*:*:*:*:*:*:*:*before 1.3.1VulnerableTP-Link
cpe:2.3:o:tp-link:er707-m2_firmware:1.3.1:-:*:*:*:*:*:*1.3.1VulnerableTP-Link
cpe:2.3:h:tp-link:er707-m2:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er7206_firmware:*:*:*:*:*:*:*:*before 2.2.2VulnerableTP-Link
cpe:2.3:o:tp-link:er7206_firmware:2.2.2:-:*:*:*:*:*:*2.2.2VulnerableTP-Link
cpe:2.3:h:tp-link:er7206:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er605_firmware:*:*:*:*:*:*:*:*before 2.3.1VulnerableTP-Link
cpe:2.3:o:tp-link:er605_firmware:2.3.1:-:*:*:*:*:*:*2.3.1VulnerableTP-Link
cpe:2.3:h:tp-link:er605:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
  • cpe:2.3:o:tp-link:g36_firmware:1.1.4:-:*:*:*:*:*:* Versions 1.1.4 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:g36:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:g611_firmware:*:*:*:*:*:*:*:* Versions before 1.2.2 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:g611_firmware:1.2.2:-:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:g611:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:fr365_firmware:*:*:*:*:*:*:*:* Versions before 1.1.10 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:fr365_firmware:1.1.10:-:*:*:*:*:*:* Versions 1.1.10 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:fr365:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:fr205_firmware:*:*:*:*:*:*:*:* Versions before 1.0.3 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:fr205_firmware:1.0.3:-:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:fr205:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:fr307-m2_firmware:*:*:*:*:*:*:*:* Versions before 1.2.5 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:fr307-m2_firmware:1.2.5:-:*:*:*:*:*:* Versions 1.2.5 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:fr307-m2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er8411_firmware:*:*:*:*:*:*:*:* Versions before 1.3.3 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:er8411_firmware:1.3.3:-:*:*:*:*:*:* Versions 1.3.3 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er8411:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er7412-m2_firmware:*:*:*:*:*:*:*:* Versions before 1.1.0 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:er7412-m2_firmware:1.1.0:-:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er7412-m2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er707-m2_firmware:*:*:*:*:*:*:*:* Versions before 1.3.1 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:er707-m2_firmware:1.3.1:-:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er707-m2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er7206_firmware:*:*:*:*:*:*:*:* Versions before 2.2.2 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:er7206_firmware:2.2.2:-:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er7206:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er605_firmware:*:*:*:*:*:*:*:* Versions before 2.3.1 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:er605_firmware:2.3.1:-:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er605:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link

Remediation

  • Fix · CNA Omada gateways (TP-Link Systems Inc.) Fixed in ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3
  • Fix · CNA Festa gateways (TP-Link Systems Inc.) Fixed in FR365 1.1.10, FR205 1.0.3, FR307 1.2.5
  • Fix · CNA Omada Pro gateways (TP-Link Systems Inc.) Fixed in G36 1.1.4, G611 1.2.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    TP-Link Systems Festa gateways, Omada Pro gateways, Omada gateways — support.omadanetworks.com/en/document/108455

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2025-05942 OS command injection in multiple parametersPriority MEDIUM 50
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-6541
  2. 2026-10-03 Alias added: GHSA-x52x-mhfj-w7qq

References

Advisory 1

Other 3

  • TI-2026-15915 Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways CVSS 4.0CRITICAL 9.3
  • TI-2025-05942 OS command injection in multiple parameters CVSS 4.0CRITICAL 9.3
  • TI-2025-07174 Authenticated OS command execution in TP-Link Omada gateways CVSS 4.0CRITICAL 9.3
  • TI-2025-07175 Unauthorized root access via debug functionality CVSS 4.0HIGH 8.7
  • TI-2026-15976 Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways CVSS 4.0MEDIUM 6.3
  • TI-2026-07940 Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways CVSS 4.0MEDIUM 6.0
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences