Read the docs
TI-2026-15915 Aliases CVE-2026-19586GHSA-32hp-8pjq-2c8g

Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways

Priority MEDIUM 57CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.  Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05724 93rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed ER7212PC v2 (TP-Link Systems Inc.): 2.4.3 Build 20260722 Rel.40250ER605 v2 (TP-Link Systems Inc.): 2.4.4 Build 20260630 Rel.14398+17 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkER7212PC v2before 2.4.3 Build 20260722 Rel.402502.4.3 Build 20260722 Rel.40250Patch availableCNA
TP-LinkER605 v2before 2.4.4 Build 20260630 Rel.143982.4.4 Build 20260630 Rel.14398Patch availableCNA
TP-LinkER7206 v2before 2.3.5 Build 20260625 Rel.431362.3.5 Build 20260625 Rel.43136Patch availableCNA
TP-LinkER7406 v1before 1.3.4 Build 20260625 Rel.431361.3.4 Build 20260625 Rel.43136Patch availableCNA
TP-LinkER707-M2 v1before 1.4.4 Build 20260625 Rel.430631.4.4 Build 20260625 Rel.43063Patch availableCNA
TP-LinkER7412-M2 v1before 1.2.0 Build 20260630 Rel.829471.2.0 Build 20260630 Rel.82947Patch availableCNA
TP-LinkER8411 v1before 1.4.1 Build 20260708 Rel.648321.4.1 Build 20260708 Rel.64832Patch availableCNA
TP-LinkER706W v1before 1.2.11 Build 20260723 Rel.415671.2.11 Build 20260723 Rel.41567Patch availableCNA
TP-Linkv1before 1.2.6 Build 20260723 Rel.413211.2.6 Build 20260723 Rel.41321Patch availableCNA
TP-LinkER706W-4G v2before 2.1.11 Build 20260723 Rel.416242.1.11 Build 20260723 Rel.41624Patch availableCNA
TP-LinkER706WP-4G v1before 1.1.11 Build 20260723 Rel.416241.1.11 Build 20260723 Rel.41624Patch availableCNA
TP-LinkER703WP-4G-Outdoor v1before 1.1.7 Build 20260723 Rel.417121.1.7 Build 20260723 Rel.41712Patch availableCNA
TP-LinkDR3220v-4G v1before 1.2.0 Build 20260630 Rel.826521.2.0 Build 20260630 Rel.82652Patch availableCNA
TP-LinkDR3650v v1before 1.2.0 Build 20260630 Rel.833111.2.0 Build 20260630 Rel.83311Patch availableCNA
TP-LinkDR3650v-4G v1before 1.2.0 Build 20260630 Rel.833471.2.0 Build 20260630 Rel.83347Patch availableCNA
TP-LinkER603WP-4G-Outdoor v1before 1.0.2 Build 20260723 Rel.432711.0.2 Build 20260723 Rel.43271Patch availableCNA
TP-LinkDR3150 v1before 1.0.1 Build 20260722 Rel.168541.0.1 Build 20260722 Rel.16854Patch availableCNA
TP-LinkER701-5G-Outdoor v1before 1.0.3 Build 20260723 Rel.409311.0.3 Build 20260723 Rel.40931Patch availableCNA
TP-LinkER605W v2before 2.0.4 Build 20260723 Rel.437632.0.4 Build 20260723 Rel.43763Patch availableCNA
  • ER7212PC v2 VendorTP-Link Affected before 2.4.3 Build 20260722 Rel.40250 Fixed in 2.4.3 Build 20260722 Rel.40250 Patch available CNA
  • ER605 v2 VendorTP-Link Affected before 2.4.4 Build 20260630 Rel.14398 Fixed in 2.4.4 Build 20260630 Rel.14398 Patch available CNA
  • ER7206 v2 VendorTP-Link Affected before 2.3.5 Build 20260625 Rel.43136 Fixed in 2.3.5 Build 20260625 Rel.43136 Patch available CNA
  • ER7406 v1 VendorTP-Link Affected before 1.3.4 Build 20260625 Rel.43136 Fixed in 1.3.4 Build 20260625 Rel.43136 Patch available CNA
  • ER707-M2 v1 VendorTP-Link Affected before 1.4.4 Build 20260625 Rel.43063 Fixed in 1.4.4 Build 20260625 Rel.43063 Patch available CNA
  • ER7412-M2 v1 VendorTP-Link Affected before 1.2.0 Build 20260630 Rel.82947 Fixed in 1.2.0 Build 20260630 Rel.82947 Patch available CNA
  • ER8411 v1 VendorTP-Link Affected before 1.4.1 Build 20260708 Rel.64832 Fixed in 1.4.1 Build 20260708 Rel.64832 Patch available CNA
  • ER706W v1 VendorTP-Link Affected before 1.2.11 Build 20260723 Rel.41567 Fixed in 1.2.11 Build 20260723 Rel.41567 Patch available CNA
  • v1 VendorTP-Link Affected before 1.2.6 Build 20260723 Rel.41321 Fixed in 1.2.6 Build 20260723 Rel.41321 Patch available CNA
  • ER706W-4G v2 VendorTP-Link Affected before 2.1.11 Build 20260723 Rel.41624 Fixed in 2.1.11 Build 20260723 Rel.41624 Patch available CNA
  • ER706WP-4G v1 VendorTP-Link Affected before 1.1.11 Build 20260723 Rel.41624 Fixed in 1.1.11 Build 20260723 Rel.41624 Patch available CNA
  • ER703WP-4G-Outdoor v1 VendorTP-Link Affected before 1.1.7 Build 20260723 Rel.41712 Fixed in 1.1.7 Build 20260723 Rel.41712 Patch available CNA
  • DR3220v-4G v1 VendorTP-Link Affected before 1.2.0 Build 20260630 Rel.82652 Fixed in 1.2.0 Build 20260630 Rel.82652 Patch available CNA
  • DR3650v v1 VendorTP-Link Affected before 1.2.0 Build 20260630 Rel.83311 Fixed in 1.2.0 Build 20260630 Rel.83311 Patch available CNA
  • DR3650v-4G v1 VendorTP-Link Affected before 1.2.0 Build 20260630 Rel.83347 Fixed in 1.2.0 Build 20260630 Rel.83347 Patch available CNA
  • ER603WP-4G-Outdoor v1 VendorTP-Link Affected before 1.0.2 Build 20260723 Rel.43271 Fixed in 1.0.2 Build 20260723 Rel.43271 Patch available CNA
  • DR3150 v1 VendorTP-Link Affected before 1.0.1 Build 20260722 Rel.16854 Fixed in 1.0.1 Build 20260722 Rel.16854 Patch available CNA
  • ER701-5G-Outdoor v1 VendorTP-Link Affected before 1.0.3 Build 20260723 Rel.40931 Fixed in 1.0.3 Build 20260723 Rel.40931 Patch available CNA
  • ER605W v2 VendorTP-Link Affected before 2.0.4 Build 20260723 Rel.43763 Fixed in 2.0.4 Build 20260723 Rel.43763 Patch available CNA

CPE configurations NVD · 38

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:er7212pc_firmware:*:*:*:*:*:*:*:*before 2.4.3VulnerableTP-Link
cpe:2.3:h:tp-link:er7212pc:2.0:*:*:*:*:*:*:*2.0Running onTP-Link
cpe:2.3:o:tp-link:er605_firmware:*:*:*:*:*:*:*:*before 2.4.4VulnerableTP-Link
cpe:2.3:h:tp-link:er605:2.0:*:*:*:*:*:*:*2.0Running onTP-Link
cpe:2.3:o:tp-link:er605w_firmware:*:*:*:*:*:*:*:*before 2.0.4VulnerableTP-Link
cpe:2.3:h:tp-link:er605w:2.0:*:*:*:*:*:*:*2.0Running onTP-Link
cpe:2.3:o:tp-link:er7206_firmware:*:*:*:*:*:*:*:*before 2.3.5VulnerableTP-Link
cpe:2.3:h:tp-link:er7206:2.0:*:*:*:*:*:*:*2.0Running onTP-Link
cpe:2.3:o:tp-link:er7406_firmware:*:*:*:*:*:*:*:*before 1.3.4VulnerableTP-Link
cpe:2.3:h:tp-link:er7406:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
  • cpe:2.3:o:tp-link:er7212pc_firmware:*:*:*:*:*:*:*:* Versions before 2.4.3 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er7212pc:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:er605_firmware:*:*:*:*:*:*:*:* Versions before 2.4.4 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er605:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:er605w_firmware:*:*:*:*:*:*:*:* Versions before 2.0.4 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er605w:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:er7206_firmware:*:*:*:*:*:*:*:* Versions before 2.3.5 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er7206:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:er7406_firmware:*:*:*:*:*:*:*:* Versions before 1.3.4 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er7406:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
Show 28 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:tp-link:er707-m2_firmware:*:*:*:*:*:*:*:*before 1.4.4VulnerableTP-Link
cpe:2.3:h:tp-link:er707-m2:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er7412-m2_firmware:*:*:*:*:*:*:*:*before 1.2.0VulnerableTP-Link
cpe:2.3:h:tp-link:er7412-m2:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er8411_firmware:*:*:*:*:*:*:*:*before 1.4.1VulnerableTP-Link
cpe:2.3:h:tp-link:er8411:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er706w_firmware:*:*:*:*:*:*:*:*before 1.2.11VulnerableTP-Link
cpe:2.3:h:tp-link:er706w:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:*before 1.2.6VulnerableTP-Link
cpe:2.3:h:tp-link:er706w-4g:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:*before 2.1.11VulnerableTP-Link
cpe:2.3:h:tp-link:er706w-4g:2.0:*:*:*:*:*:*:*2.0Running onTP-Link
cpe:2.3:o:tp-link:er706wp-4g_firmware:*:*:*:*:*:*:*:*before 1.1.11VulnerableTP-Link
cpe:2.3:h:tp-link:er706wp-4g:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er703wp-4g-outdoor_firmware:*:*:*:*:*:*:*:*before 1.1.7VulnerableTP-Link
cpe:2.3:h:tp-link:er703wp-4g-outdoor:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er603wp-4g-outdoor_firmware:*:*:*:*:*:*:*:*before 1.0.2VulnerableTP-Link
cpe:2.3:h:tp-link:er603wp-4g-outdoor:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er701-5g-outdoor_firmware:*:*:*:*:*:*:*:*before 1.0.3VulnerableTP-Link
cpe:2.3:h:tp-link:er701-5g-outdoor:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:dr3220v-4g_firmware:*:*:*:*:*:*:*:*before 1.2.0VulnerableTP-Link
cpe:2.3:h:tp-link:dr3220v-4g:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:dr3650v_firmware:*:*:*:*:*:*:*:*before 1.2.0VulnerableTP-Link
cpe:2.3:h:tp-link:dr3650v:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:dr3650v-4g_firmware:*:*:*:*:*:*:*:*before 1.2.0VulnerableTP-Link
cpe:2.3:h:tp-link:dr3650v-4g:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:dr3150_firmware:*:*:*:*:*:*:*:*before 1.0.1VulnerableTP-Link
cpe:2.3:h:tp-link:dr3150:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
  • cpe:2.3:o:tp-link:er707-m2_firmware:*:*:*:*:*:*:*:* Versions before 1.4.4 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er707-m2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er7412-m2_firmware:*:*:*:*:*:*:*:* Versions before 1.2.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er7412-m2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er8411_firmware:*:*:*:*:*:*:*:* Versions before 1.4.1 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er8411:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er706w_firmware:*:*:*:*:*:*:*:* Versions before 1.2.11 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er706w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:* Versions before 1.2.6 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er706w-4g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:* Versions before 2.1.11 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er706w-4g:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:er706wp-4g_firmware:*:*:*:*:*:*:*:* Versions before 1.1.11 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er706wp-4g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er703wp-4g-outdoor_firmware:*:*:*:*:*:*:*:* Versions before 1.1.7 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er703wp-4g-outdoor:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er603wp-4g-outdoor_firmware:*:*:*:*:*:*:*:* Versions before 1.0.2 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er603wp-4g-outdoor:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er701-5g-outdoor_firmware:*:*:*:*:*:*:*:* Versions before 1.0.3 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er701-5g-outdoor:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:dr3220v-4g_firmware:*:*:*:*:*:*:*:* Versions before 1.2.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:dr3220v-4g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:dr3650v_firmware:*:*:*:*:*:*:*:* Versions before 1.2.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:dr3650v:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:dr3650v-4g_firmware:*:*:*:*:*:*:*:* Versions before 1.2.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:dr3650v-4g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:dr3150_firmware:*:*:*:*:*:*:*:* Versions before 1.0.1 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:dr3150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link

Remediation

  • Fix · CNA ER7212PC v2 (TP-Link Systems Inc.) Fixed in 2.4.3 Build 20260722 Rel.40250
  • Fix · CNA ER605 v2 (TP-Link Systems Inc.) Fixed in 2.4.4 Build 20260630 Rel.14398
  • Fix · CNA ER7206 v2 (TP-Link Systems Inc.) Fixed in 2.3.5 Build 20260625 Rel.43136
  • Fix · CNA ER7406 v1 (TP-Link Systems Inc) Fixed in 1.3.4 Build 20260625 Rel.43136
  • Fix · CNA ER707-M2 v1 (TP-Link Systems Inc.) Fixed in 1.4.4 Build 20260625 Rel.43063
  • Fix · CNA ER7412-M2 v1 (TP-Link Systems Inc) Fixed in 1.2.0 Build 20260630 Rel.82947
  • Fix · CNA ER8411 v1 (TP-Link Systems Inc.) Fixed in 1.4.1 Build 20260708 Rel.64832
  • Fix · CNA ER706W v1 (TP-Link Systems Inc.) Fixed in 1.2.11 Build 20260723 Rel.41567
  • Fix · CNA v1 (TP-Link Systems Inc.) Fixed in 1.2.6 Build 20260723 Rel.41321
  • Fix · CNA ER706W-4G v2 (TP-Link Systems Inc.) Fixed in 2.1.11 Build 20260723 Rel.41624
  • Fix · CNA ER706WP-4G v1 (TP-Link Systems Inc.) Fixed in 1.1.11 Build 20260723 Rel.41624
  • Fix · CNA ER703WP-4G-Outdoor v1 (TP-Link Systems Inc.) Fixed in 1.1.7 Build 20260723 Rel.41712
  • Fix · CNA DR3220v-4G v1 (TP-Link Systems Inc.) Fixed in 1.2.0 Build 20260630 Rel.82652
  • Fix · CNA DR3650v v1 (TP-Link Systems Inc.) Fixed in 1.2.0 Build 20260630 Rel.83311
  • Fix · CNA DR3650v-4G v1 (TP-Link Systems Inc.) Fixed in 1.2.0 Build 20260630 Rel.83347
  • Fix · CNA ER603WP-4G-Outdoor v1 (TP-Link Systems Inc.) Fixed in 1.0.2 Build 20260723 Rel.43271
  • Fix · CNA DR3150 v1 (TP-Link Systems Inc.) Fixed in 1.0.1 Build 20260722 Rel.16854
  • Fix · CNA ER701-5G-Outdoor v1 (TP-Link Systems Inc.) Fixed in 1.0.3 Build 20260723 Rel.40931
  • Fix · CNA ER605W v2 (TP-Link Systems Inc.) Fixed in 2.0.4 Build 20260723 Rel.43763

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    TP-Link Systems DR3150 v1, DR3220v-4G v1 and 17 more products — tp-link.com/us/support/faq/5256

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-15976 Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada GatewaysPriority LOW 28
    • TI-2026-07940 Unauthenticated Captive Portal Session Termination and Forced Logout in Omada GatewaysPriority LOW 27
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-19586
  2. 2026-10-03 Alias added: GHSA-32hp-8pjq-2c8g

References

Exploit 1

Patch 2

Advisory 1

  • TI-2026-15976 Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways CVSS 4.0MEDIUM 6.3
  • TI-2026-07940 Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways CVSS 4.0MEDIUM 6.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences