Read the docs
TI-2025-07174 Aliases CVE-2025-7850GHSA-5r6g-vjqj-7mwg

Authenticated OS command execution in TP-Link Omada gateways

Priority MEDIUM 48CWE-78Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03308 88th percentileScored 2026-11-07
Fix Fixed Omada gateways (TP-Link Systems Inc.): ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1 +5Festa gateways (TP-Link Systems Inc.): FR365 1.1.10, FR205 1.0.3, FR307 1.2.5+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkOmada gatewaysbefore ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3Patch availableCNA
TP-LinkFesta gatewaysbefore FR365 1.1.10, FR205 1.0.3, FR307 1.2.5FR365 1.1.10, FR205 1.0.3, FR307 1.2.5Patch availableCNA
TP-LinkOmada Pro gatewaysbefore G36 1.1.4, G611 1.2.2G36 1.1.4, G611 1.2.2Patch availableCNA
  • Omada gateways VendorTP-Link Affected before ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3 Fixed in ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3 Patch available CNA
  • Festa gateways VendorTP-Link Affected before FR365 1.1.10, FR205 1.0.3, FR307 1.2.5 Fixed in FR365 1.1.10, FR205 1.0.3, FR307 1.2.5 Patch available CNA
  • Omada Pro gateways VendorTP-Link Affected before G36 1.1.4, G611 1.2.2 Fixed in G36 1.1.4, G611 1.2.2 Patch available CNA

CPE configurations NVD · 39

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:er8411_firmware:*:*:*:*:*:*:*:*before 1.3.3VulnerableTP-Link
cpe:2.3:o:tp-link:er8411_firmware:1.3.3:-:*:*:*:*:*:*1.3.3VulnerableTP-Link
cpe:2.3:h:tp-link:er8411:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er7412-m2_firmware:*:*:*:*:*:*:*:*before 1.1.0VulnerableTP-Link
cpe:2.3:o:tp-link:er7412-m2_firmware:1.1.0:-:*:*:*:*:*:*1.1.0VulnerableTP-Link
cpe:2.3:h:tp-link:er7412-m2:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er707-m2_firmware:*:*:*:*:*:*:*:*before 1.3.1VulnerableTP-Link
cpe:2.3:o:tp-link:er707-m2_firmware:1.3.1:-:*:*:*:*:*:*1.3.1VulnerableTP-Link
cpe:2.3:h:tp-link:er707-m2:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er7206_firmware:*:*:*:*:*:*:*:*before 2.2.2VulnerableTP-Link
  • cpe:2.3:o:tp-link:er8411_firmware:*:*:*:*:*:*:*:* Versions before 1.3.3 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:er8411_firmware:1.3.3:-:*:*:*:*:*:* Versions 1.3.3 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er8411:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er7412-m2_firmware:*:*:*:*:*:*:*:* Versions before 1.1.0 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:er7412-m2_firmware:1.1.0:-:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er7412-m2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er707-m2_firmware:*:*:*:*:*:*:*:* Versions before 1.3.1 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:er707-m2_firmware:1.3.1:-:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er707-m2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er7206_firmware:*:*:*:*:*:*:*:* Versions before 2.2.2 Vulnerable ·TP-Link
Show 29 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:tp-link:er7206_firmware:2.2.2:-:*:*:*:*:*:*2.2.2VulnerableTP-Link
cpe:2.3:h:tp-link:er7206:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er605_firmware:*:*:*:*:*:*:*:*before 2.3.1VulnerableTP-Link
cpe:2.3:o:tp-link:er605_firmware:2.3.1:-:*:*:*:*:*:*2.3.1VulnerableTP-Link
cpe:2.3:h:tp-link:er605:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er706w_firmware:*:*:*:*:*:*:*:*before 1.2.1VulnerableTP-Link
cpe:2.3:o:tp-link:er706w_firmware:1.2.1:-:*:*:*:*:*:*1.2.1VulnerableTP-Link
cpe:2.3:h:tp-link:er706w:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:*before 1.2.1VulnerableTP-Link
cpe:2.3:o:tp-link:er706w-4g_firmware:1.2.1:-:*:*:*:*:*:*1.2.1VulnerableTP-Link
cpe:2.3:h:tp-link:er706w-4g:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er7212pc_firmware:*:*:*:*:*:*:*:*before 2.1.3VulnerableTP-Link
cpe:2.3:o:tp-link:er7212pc_firmware:2.1.3:-:*:*:*:*:*:*2.1.3VulnerableTP-Link
cpe:2.3:h:tp-link:er7212pc:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:g36_firmware:*:*:*:*:*:*:*:*before 1.1.4VulnerableTP-Link
cpe:2.3:o:tp-link:g36_firmware:1.1.4:-:*:*:*:*:*:*1.1.4VulnerableTP-Link
cpe:2.3:h:tp-link:g36:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:g611_firmware:*:*:*:*:*:*:*:*before 1.2.2VulnerableTP-Link
cpe:2.3:o:tp-link:g611_firmware:1.2.2:-:*:*:*:*:*:*1.2.2VulnerableTP-Link
cpe:2.3:h:tp-link:g611:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:fr365_firmware:*:*:*:*:*:*:*:*before 1.1.10VulnerableTP-Link
cpe:2.3:o:tp-link:fr365_firmware:1.1.10:-:*:*:*:*:*:*1.1.10VulnerableTP-Link
cpe:2.3:h:tp-link:fr365:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:fr205_firmware:*:*:*:*:*:*:*:*before 1.0.3VulnerableTP-Link
cpe:2.3:o:tp-link:fr205_firmware:1.0.3:-:*:*:*:*:*:*1.0.3VulnerableTP-Link
cpe:2.3:h:tp-link:fr205:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:fr307-m2_firmware:*:*:*:*:*:*:*:*before 1.2.5VulnerableTP-Link
cpe:2.3:o:tp-link:fr307-m2_firmware:1.2.5:-:*:*:*:*:*:*1.2.5VulnerableTP-Link
cpe:2.3:h:tp-link:fr307-m2:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
  • cpe:2.3:o:tp-link:er7206_firmware:2.2.2:-:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er7206:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er605_firmware:*:*:*:*:*:*:*:* Versions before 2.3.1 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:er605_firmware:2.3.1:-:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er605:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er706w_firmware:*:*:*:*:*:*:*:* Versions before 1.2.1 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:er706w_firmware:1.2.1:-:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er706w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:* Versions before 1.2.1 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:er706w-4g_firmware:1.2.1:-:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er706w-4g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er7212pc_firmware:*:*:*:*:*:*:*:* Versions before 2.1.3 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:er7212pc_firmware:2.1.3:-:*:*:*:*:*:* Versions 2.1.3 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er7212pc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:g36_firmware:*:*:*:*:*:*:*:* Versions before 1.1.4 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:g36_firmware:1.1.4:-:*:*:*:*:*:* Versions 1.1.4 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:g36:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:g611_firmware:*:*:*:*:*:*:*:* Versions before 1.2.2 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:g611_firmware:1.2.2:-:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:g611:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:fr365_firmware:*:*:*:*:*:*:*:* Versions before 1.1.10 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:fr365_firmware:1.1.10:-:*:*:*:*:*:* Versions 1.1.10 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:fr365:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:fr205_firmware:*:*:*:*:*:*:*:* Versions before 1.0.3 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:fr205_firmware:1.0.3:-:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:fr205:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:fr307-m2_firmware:*:*:*:*:*:*:*:* Versions before 1.2.5 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:fr307-m2_firmware:1.2.5:-:*:*:*:*:*:* Versions 1.2.5 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:fr307-m2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link

Remediation

  • Fix · CNA Omada gateways (TP-Link Systems Inc.) Fixed in ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3
  • Fix · CNA Festa gateways (TP-Link Systems Inc.) Fixed in FR365 1.1.10, FR205 1.0.3, FR307 1.2.5
  • Fix · CNA Omada Pro gateways (TP-Link Systems Inc.) Fixed in G36 1.1.4, G611 1.2.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    TP-Link Systems Festa gateways, Omada Pro gateways, Omada gateways — support.omadanetworks.com/en/document/108456

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2025-07175 Unauthorized root access via debug functionalityPriority MEDIUM 41
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-7850
  2. 2026-10-03 Alias added: GHSA-5r6g-vjqj-7mwg

References

Advisory 1

Other 4

  • TI-2026-15915 Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways CVSS 4.0CRITICAL 9.3
  • TI-2025-05942 OS command injection in multiple parameters CVSS 4.0CRITICAL 9.3
  • TI-2025-05941 OS command injection using information obtained from the web management interface CVSS 4.0HIGH 8.6
  • TI-2025-07175 Unauthorized root access via debug functionality CVSS 4.0HIGH 8.7
  • TI-2026-15976 Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways CVSS 4.0MEDIUM 6.3
  • TI-2026-07940 Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways CVSS 4.0MEDIUM 6.0
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences