CVE-2026-19586

CVE-2026-19586 is a pre-authentication OS command injection flaw in TP-Link Omada gateways running the OpenVPN Server feature, caused by insufficient validation of client-supplied data during connection establishment. CVSS 9.3 (Critical), network-reachable, no auth required. Exploitation requires...

CVE-2025-6542

CVE-2025-6542 affects TP-Link Omada Gateway devices and is described as an OS command injection vulnerability that can be triggered by a remote unauthenticated attacker via multiple parameters and the web management interface. The connected coverage confirms this is a remote code execution vector...

CVE-2026-19683

A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways . During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel . An attacker with visibility or control of the relevant network path can obtain ...

CVE-2025-9290

CVE-2025-9290 describes an authentication weakness in Omada Controllers, Gateways, and Access Points related to improper handling of random values during controller-device adoption. The vulnerability could allow an attacker with adjacent network access to intercept adoption traffic and forge vali...

CVE-2026-9033

CVE-2026-9033 affects TP-Link Omada Gateways . An unauthenticated attacker with adjacent network access to the captive portal service can terminate active sessions, either forcing logout of specific users or clearing all sessions, causing temporary service disruption and requiring re-authenticati...

CVE-2025-6541

CVE-2025-6541 affects TP-Link Omada gateway devices. The flaw allows command injection in the device OS via the web management interface, exploitable by an authenticated user to run arbitrary commands. Impact is high per CVSS. TP-Link issued firmware updates addressing this and similar flaws; use...

CVE-2025-7851

CVE-2025-7851 affects TP-Link Omada gateways. Connected documents corroborate that an attacker may obtain the root shell on the underlying OS under restricted conditions, via issues described as unauthorized root access through a residual debug code/path and improper privilege management. The vul...

CVE-2025-7850

CVE-2025-7850 is an authenticated OS command injection affecting TP-Link Omada gateway devices. The TP-Link/THN coverage describes exploitation via the WireGuard VPN settings where improper sanitization enables arbitrary OS commands (root) after admin authentication, with two other Omada flaws pa...