Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

8 records

Vendor: TP-Link Component: Er605 Firmware Clear all filters
TI-2026-15915 CVE-2026-19586 · GHSA-32hp-8pjq-2c8g

Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways

Priority MEDIUM 57

A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection es…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.05772 Published 2026-08-20 Fixed in 2.4.3 Build 20260722 Rel.40250, 2.4.4 Build 20260630 Rel.14398 +17 CWE-78
TI-2026-07940 CVE-2026-9033 · GHSA-fpm4-hq62-cqf6

Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways

Priority LOW 27

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions…

CVSS 4.0MEDIUM 6.0 Adjacent network No auth No interaction EPSS 0.00277 Published 2026-08-20 Fixed in 2.4.3 Build 20260722 Rel.40250, 2.4.4 Build 20260630 Rel.14398 +17 CWE-306
TI-2025-08515 CVE-2025-9290 · GHSA-gwgw-6q3h-28pg

Authentication Weakness on Omada Controllers, Gateways and Access Points

Priority LOW 26

An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values.

CVSS 4.0MEDIUM 6.0 Adjacent network No auth No interaction EPSS 0.00222 Published 2026-01-22 Fixed in 6.0.0.24, 6.0.0.100 +27 CWE-760
TI-2025-07175 CVE-2025-7851 · GHSA-q2rh-fc48-r3gw

Unauthorized root access via debug functionality

Priority MEDIUM 41

An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.

CVSS 4.0HIGH 8.7 Adjacent network High privileges No interaction EPSS 0.00674 Published 2025-10-21 Fixed in ER8411 1.3.3, ER7412-M2 1.1.0 +11 CWE-269
TI-2025-07174 CVE-2025-7850 · GHSA-5r6g-vjqj-7mwg

Authenticated OS command execution in TP-Link Omada gateways

Priority MEDIUM 48

A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.

CVSS 4.0CRITICAL 9.3 Adjacent network High privileges No interaction EPSS 0.03308 Published 2025-10-21 Fixed in ER8411 1.3.3, ER7412-M2 1.1.0 +11 CWE-78
TI-2025-05942 CVE-2025-6542 · GHSA-v223-4hv2-g25q

OS command injection in multiple parameters

Priority MEDIUM 50

An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01015 Published 2025-10-21 Fixed in ER8411 1.3.3, ER7412-M2 1.1.0 +11 CWE-78