Search criteria
39 vulnerabilities found for er7206_firmware by tp-link
FKIE_CVE-2025-7850
Vulnerability from fkie_nvd - Published: 2025-10-21 01:15 - Updated: 2025-10-24 17:15
Severity ?
Summary
A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tp-link | er8411_firmware | * | |
| tp-link | er8411_firmware | 1.3.3 | |
| tp-link | er8411 | - | |
| tp-link | er7412-m2_firmware | * | |
| tp-link | er7412-m2_firmware | 1.1.0 | |
| tp-link | er7412-m2 | - | |
| tp-link | er707-m2_firmware | * | |
| tp-link | er707-m2_firmware | 1.3.1 | |
| tp-link | er707-m2 | - | |
| tp-link | er7206_firmware | * | |
| tp-link | er7206_firmware | 2.2.2 | |
| tp-link | er7206 | - | |
| tp-link | er605_firmware | * | |
| tp-link | er605_firmware | 2.3.1 | |
| tp-link | er605 | - | |
| tp-link | er706w_firmware | * | |
| tp-link | er706w_firmware | 1.2.1 | |
| tp-link | er706w | - | |
| tp-link | er706w-4g_firmware | * | |
| tp-link | er706w-4g_firmware | 1.2.1 | |
| tp-link | er706w-4g | - | |
| tp-link | er7212pc_firmware | * | |
| tp-link | er7212pc_firmware | 2.1.3 | |
| tp-link | er7212pc | - | |
| tp-link | g36_firmware | * | |
| tp-link | g36_firmware | 1.1.4 | |
| tp-link | g36 | - | |
| tp-link | g611_firmware | * | |
| tp-link | g611_firmware | 1.2.2 | |
| tp-link | g611 | - | |
| tp-link | fr365_firmware | * | |
| tp-link | fr365_firmware | 1.1.10 | |
| tp-link | fr365 | - | |
| tp-link | fr205_firmware | * | |
| tp-link | fr205_firmware | 1.0.3 | |
| tp-link | fr205 | - | |
| tp-link | fr307-m2_firmware | * | |
| tp-link | fr307-m2_firmware | 1.2.5 | |
| tp-link | fr307-m2 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er8411_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EE0D8327-33EE-4EF0-BC2F-F2A16D55762A",
"versionEndExcluding": "1.3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er8411_firmware:1.3.3:-:*:*:*:*:*:*",
"matchCriteriaId": "6DB13EF6-0930-4575-92DC-AF431B2A2CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er8411:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4F2F16D8-5D7B-4E01-8BB3-F324B6011F72",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er7412-m2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "14CE8275-E546-4598-901C-F52355DED3C9",
"versionEndExcluding": "1.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er7412-m2_firmware:1.1.0:-:*:*:*:*:*:*",
"matchCriteriaId": "B79E0763-6D6F-4E59-91FC-D397A8BEF0F1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er7412-m2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FBB89DAE-6264-4F26-B34A-E1B84FB927D4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er707-m2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "48EDBC5B-BA54-4D11-9391-4FA7C7D4F5E7",
"versionEndExcluding": "1.3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er707-m2_firmware:1.3.1:-:*:*:*:*:*:*",
"matchCriteriaId": "359ADA2C-F1A5-4840-8F84-2DBA8F4573C4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er707-m2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E45AF81F-1346-4FD8-9E38-CAB330D79AB6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er7206_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AF595A8A-72CF-406E-BB0C-B76FDD51150B",
"versionEndExcluding": "2.2.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er7206_firmware:2.2.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8F66B05E-0D03-4B59-BCA3-7A2F40F092EE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er7206:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB65324D-FD72-4C28-92AF-85BFF1E8A993",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er605_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8EA51B29-39FB-4880-979B-3F612DE9D202",
"versionEndExcluding": "2.3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er605_firmware:2.3.1:-:*:*:*:*:*:*",
"matchCriteriaId": "1D1D1C14-E0F9-430D-BAC5-4F0C7287FD26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er605:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9892BC7C-6EA7-469B-AD26-6E5093DB5AB2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er706w_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "47273FE0-6E22-437E-B27F-058456E7602A",
"versionEndExcluding": "1.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er706w_firmware:1.2.1:-:*:*:*:*:*:*",
"matchCriteriaId": "AC30DFD7-30FD-482C-B8EF-9DDB98E269BF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er706w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7D599C4B-4A58-45EC-BA17-332FBF6E9805",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E1BC6D9F-A556-468A-8770-6A39F09F26D6",
"versionEndExcluding": "1.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er706w-4g_firmware:1.2.1:-:*:*:*:*:*:*",
"matchCriteriaId": "96944BD2-388F-4CF6-BFD3-473EE6624F74",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er706w-4g:-:*:*:*:*:*:*:*",
"matchCriteriaId": "559FA8D2-3055-41CB-81A4-A7996D93588D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er7212pc_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6CE877B8-E287-4FE6-84D5-666FE27AC9A6",
"versionEndExcluding": "2.1.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er7212pc_firmware:2.1.3:-:*:*:*:*:*:*",
"matchCriteriaId": "24860FF1-7CA9-47D4-90B6-CB8915F1D992",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er7212pc:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F300A161-E1A3-469E-9DE3-9B052F6BA8AC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:g36_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EB884461-7A80-44B0-A200-25D7E0EB5152",
"versionEndExcluding": "1.1.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:g36_firmware:1.1.4:-:*:*:*:*:*:*",
"matchCriteriaId": "BDA7D066-8443-4D6F-8E22-A0845236B490",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:g36:-:*:*:*:*:*:*:*",
"matchCriteriaId": "153073B7-9FBD-47D0-A1AB-CEE323AE5512",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:g611_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6F8E98F-0C86-40C0-BBD3-D2B1889BAA87",
"versionEndExcluding": "1.2.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:g611_firmware:1.2.2:-:*:*:*:*:*:*",
"matchCriteriaId": "5FF584E3-70F0-4B05-857B-CE07D87BA130",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:g611:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D4BA74E1-BDA0-4FDD-820A-8DE32EEE2AA7",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:fr365_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D38B9DBD-3397-40B8-B4A5-C1E0C248C300",
"versionEndExcluding": "1.1.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:fr365_firmware:1.1.10:-:*:*:*:*:*:*",
"matchCriteriaId": "4DA30139-EBED-40FD-BA20-CED14607B648",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:fr365:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB3D95C-C64A-48A6-8D13-E158CFB3CC7C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:fr205_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7FC1549-BC5C-45CF-8524-6DFFB4193D1B",
"versionEndExcluding": "1.0.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:fr205_firmware:1.0.3:-:*:*:*:*:*:*",
"matchCriteriaId": "532C5C8D-3AC4-4596-8D8C-6855686BD92A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:fr205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "56799602-9EF3-47D5-86CC-9AA2AE3013CF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:fr307-m2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6952617F-CF3F-4EB4-89B3-0C7076EEEEBC",
"versionEndExcluding": "1.2.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:fr307-m2_firmware:1.2.5:-:*:*:*:*:*:*",
"matchCriteriaId": "5FDFE511-0244-454D-8D3F-C7E46D499FC5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:fr307-m2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2559CDDD-2C81-49A8-BF42-B3F6AC68F5F0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A command injection vulnerability may be exploited after the admin\u0027s authentication on the web portal on Omada gateways."
}
],
"id": "CVE-2025-7850",
"lastModified": "2025-10-24T17:15:43.243",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"type": "Secondary"
}
]
},
"published": "2025-10-21T01:15:37.193",
"references": [
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Vendor Advisory"
],
"url": "https://support.omadanetworks.com/en/document/108456/"
},
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"url": "https://www.forescout.com/blog/new-tp-link-router-vulnerabilities-a-primer-on-rooting-routers/"
},
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Product"
],
"url": "https://www.omadanetworks.com/us/business-networking/all-omada-router/"
},
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Product"
],
"url": "https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/"
},
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Product"
],
"url": "https://www.tp-link.com/us/business-networking/soho-festa-gateway/"
}
],
"sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"type": "Secondary"
}
]
}
FKIE_CVE-2025-6542
Vulnerability from fkie_nvd - Published: 2025-10-21 01:15 - Updated: 2025-10-24 13:50
Severity ?
Summary
An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tp-link | er8411_firmware | * | |
| tp-link | er8411_firmware | 1.3.3 | |
| tp-link | er8411 | - | |
| tp-link | er7412-m2_firmware | * | |
| tp-link | er7412-m2_firmware | 1.1.0 | |
| tp-link | er7412-m2 | - | |
| tp-link | er707-m2_firmware | * | |
| tp-link | er707-m2_firmware | 1.3.1 | |
| tp-link | er707-m2 | - | |
| tp-link | er7206_firmware | * | |
| tp-link | er7206_firmware | 2.2.2 | |
| tp-link | er7206 | - | |
| tp-link | er605_firmware | * | |
| tp-link | er605_firmware | 2.3.1 | |
| tp-link | er605 | - | |
| tp-link | er706w_firmware | * | |
| tp-link | er706w_firmware | 1.2.1 | |
| tp-link | er706w | - | |
| tp-link | er706w-4g_firmware | * | |
| tp-link | er706w-4g_firmware | 1.2.1 | |
| tp-link | er706w-4g | - | |
| tp-link | er7212pc_firmware | * | |
| tp-link | er7212pc_firmware | 2.1.3 | |
| tp-link | er7212pc | - | |
| tp-link | g36_firmware | * | |
| tp-link | g36_firmware | 1.1.4 | |
| tp-link | g36 | - | |
| tp-link | g611_firmware | * | |
| tp-link | g611_firmware | 1.2.2 | |
| tp-link | g611 | - | |
| tp-link | fr365_firmware | * | |
| tp-link | fr365_firmware | 1.1.10 | |
| tp-link | fr365 | - | |
| tp-link | fr205_firmware | * | |
| tp-link | fr205_firmware | 1.0.3 | |
| tp-link | fr205 | - | |
| tp-link | fr307-m2_firmware | * | |
| tp-link | fr307-m2_firmware | 1.2.5 | |
| tp-link | fr307-m2 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er8411_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EE0D8327-33EE-4EF0-BC2F-F2A16D55762A",
"versionEndExcluding": "1.3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er8411_firmware:1.3.3:-:*:*:*:*:*:*",
"matchCriteriaId": "6DB13EF6-0930-4575-92DC-AF431B2A2CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er8411:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4F2F16D8-5D7B-4E01-8BB3-F324B6011F72",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er7412-m2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "14CE8275-E546-4598-901C-F52355DED3C9",
"versionEndExcluding": "1.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er7412-m2_firmware:1.1.0:-:*:*:*:*:*:*",
"matchCriteriaId": "B79E0763-6D6F-4E59-91FC-D397A8BEF0F1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er7412-m2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FBB89DAE-6264-4F26-B34A-E1B84FB927D4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er707-m2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "48EDBC5B-BA54-4D11-9391-4FA7C7D4F5E7",
"versionEndExcluding": "1.3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er707-m2_firmware:1.3.1:-:*:*:*:*:*:*",
"matchCriteriaId": "359ADA2C-F1A5-4840-8F84-2DBA8F4573C4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er707-m2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E45AF81F-1346-4FD8-9E38-CAB330D79AB6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er7206_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AF595A8A-72CF-406E-BB0C-B76FDD51150B",
"versionEndExcluding": "2.2.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er7206_firmware:2.2.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8F66B05E-0D03-4B59-BCA3-7A2F40F092EE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er7206:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB65324D-FD72-4C28-92AF-85BFF1E8A993",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er605_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8EA51B29-39FB-4880-979B-3F612DE9D202",
"versionEndExcluding": "2.3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er605_firmware:2.3.1:-:*:*:*:*:*:*",
"matchCriteriaId": "1D1D1C14-E0F9-430D-BAC5-4F0C7287FD26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er605:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9892BC7C-6EA7-469B-AD26-6E5093DB5AB2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er706w_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "47273FE0-6E22-437E-B27F-058456E7602A",
"versionEndExcluding": "1.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er706w_firmware:1.2.1:-:*:*:*:*:*:*",
"matchCriteriaId": "AC30DFD7-30FD-482C-B8EF-9DDB98E269BF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er706w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7D599C4B-4A58-45EC-BA17-332FBF6E9805",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E1BC6D9F-A556-468A-8770-6A39F09F26D6",
"versionEndExcluding": "1.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er706w-4g_firmware:1.2.1:-:*:*:*:*:*:*",
"matchCriteriaId": "96944BD2-388F-4CF6-BFD3-473EE6624F74",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er706w-4g:-:*:*:*:*:*:*:*",
"matchCriteriaId": "559FA8D2-3055-41CB-81A4-A7996D93588D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er7212pc_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6CE877B8-E287-4FE6-84D5-666FE27AC9A6",
"versionEndExcluding": "2.1.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er7212pc_firmware:2.1.3:-:*:*:*:*:*:*",
"matchCriteriaId": "24860FF1-7CA9-47D4-90B6-CB8915F1D992",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er7212pc:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F300A161-E1A3-469E-9DE3-9B052F6BA8AC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:g36_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EB884461-7A80-44B0-A200-25D7E0EB5152",
"versionEndExcluding": "1.1.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:g36_firmware:1.1.4:-:*:*:*:*:*:*",
"matchCriteriaId": "BDA7D066-8443-4D6F-8E22-A0845236B490",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:g36:-:*:*:*:*:*:*:*",
"matchCriteriaId": "153073B7-9FBD-47D0-A1AB-CEE323AE5512",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:g611_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6F8E98F-0C86-40C0-BBD3-D2B1889BAA87",
"versionEndExcluding": "1.2.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:g611_firmware:1.2.2:-:*:*:*:*:*:*",
"matchCriteriaId": "5FF584E3-70F0-4B05-857B-CE07D87BA130",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:g611:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D4BA74E1-BDA0-4FDD-820A-8DE32EEE2AA7",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:fr365_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D38B9DBD-3397-40B8-B4A5-C1E0C248C300",
"versionEndExcluding": "1.1.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:fr365_firmware:1.1.10:-:*:*:*:*:*:*",
"matchCriteriaId": "4DA30139-EBED-40FD-BA20-CED14607B648",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:fr365:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB3D95C-C64A-48A6-8D13-E158CFB3CC7C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:fr205_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7FC1549-BC5C-45CF-8524-6DFFB4193D1B",
"versionEndExcluding": "1.0.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:fr205_firmware:1.0.3:-:*:*:*:*:*:*",
"matchCriteriaId": "532C5C8D-3AC4-4596-8D8C-6855686BD92A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:fr205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "56799602-9EF3-47D5-86CC-9AA2AE3013CF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:fr307-m2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6952617F-CF3F-4EB4-89B3-0C7076EEEEBC",
"versionEndExcluding": "1.2.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:fr307-m2_firmware:1.2.5:-:*:*:*:*:*:*",
"matchCriteriaId": "5FDFE511-0244-454D-8D3F-C7E46D499FC5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:fr307-m2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2559CDDD-2C81-49A8-BF42-B3F6AC68F5F0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An arbitrary OS command may be executed on the product by a remote unauthenticated attacker."
}
],
"id": "CVE-2025-6542",
"lastModified": "2025-10-24T13:50:10.897",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"type": "Secondary"
}
]
},
"published": "2025-10-21T01:15:37.063",
"references": [
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Vendor Advisory"
],
"url": "https://support.omadanetworks.com/en/document/108455/"
},
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Product"
],
"url": "https://www.omadanetworks.com/us/business-networking/all-omada-router/"
},
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Product"
],
"url": "https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/"
},
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Product"
],
"url": "https://www.tp-link.com/us/business-networking/soho-festa-gateway/"
}
],
"sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"type": "Secondary"
}
]
}
FKIE_CVE-2025-7851
Vulnerability from fkie_nvd - Published: 2025-10-21 01:15 - Updated: 2025-10-24 17:15
Severity ?
Summary
An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tp-link | fr307-m2_firmware | * | |
| tp-link | fr307-m2_firmware | 1.2.5 | |
| tp-link | fr307-m2 | - | |
| tp-link | fr205_firmware | * | |
| tp-link | fr205_firmware | 1.0.3 | |
| tp-link | fr205 | - | |
| tp-link | fr365_firmware | * | |
| tp-link | fr365_firmware | 1.1.10 | |
| tp-link | fr365 | - | |
| tp-link | g611_firmware | * | |
| tp-link | g611_firmware | 1.2.2 | |
| tp-link | g611 | - | |
| tp-link | g36_firmware | * | |
| tp-link | g36_firmware | 1.1.4 | |
| tp-link | g36 | - | |
| tp-link | er7212pc_firmware | * | |
| tp-link | er7212pc_firmware | 2.1.3 | |
| tp-link | er7212pc | - | |
| tp-link | er706w-4g_firmware | * | |
| tp-link | er706w-4g_firmware | 1.2.1 | |
| tp-link | er706w-4g | - | |
| tp-link | er706w_firmware | * | |
| tp-link | er706w_firmware | 1.2.1 | |
| tp-link | er706w | - | |
| tp-link | er605_firmware | * | |
| tp-link | er605_firmware | 2.3.1 | |
| tp-link | er605 | - | |
| tp-link | er7206_firmware | * | |
| tp-link | er7206_firmware | 2.2.2 | |
| tp-link | er7206 | - | |
| tp-link | er707-m2_firmware | * | |
| tp-link | er707-m2_firmware | 1.3.1 | |
| tp-link | er707-m2 | - | |
| tp-link | er7412-m2_firmware | * | |
| tp-link | er7412-m2_firmware | 1.1.0 | |
| tp-link | er7412-m2 | - | |
| tp-link | er8411_firmware | * | |
| tp-link | er8411_firmware | 1.3.3 | |
| tp-link | er8411 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:fr307-m2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6952617F-CF3F-4EB4-89B3-0C7076EEEEBC",
"versionEndExcluding": "1.2.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:fr307-m2_firmware:1.2.5:-:*:*:*:*:*:*",
"matchCriteriaId": "5FDFE511-0244-454D-8D3F-C7E46D499FC5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:fr307-m2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2559CDDD-2C81-49A8-BF42-B3F6AC68F5F0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:fr205_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7FC1549-BC5C-45CF-8524-6DFFB4193D1B",
"versionEndExcluding": "1.0.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:fr205_firmware:1.0.3:-:*:*:*:*:*:*",
"matchCriteriaId": "532C5C8D-3AC4-4596-8D8C-6855686BD92A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:fr205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "56799602-9EF3-47D5-86CC-9AA2AE3013CF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:fr365_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D38B9DBD-3397-40B8-B4A5-C1E0C248C300",
"versionEndExcluding": "1.1.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:fr365_firmware:1.1.10:-:*:*:*:*:*:*",
"matchCriteriaId": "4DA30139-EBED-40FD-BA20-CED14607B648",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:fr365:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB3D95C-C64A-48A6-8D13-E158CFB3CC7C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:g611_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6F8E98F-0C86-40C0-BBD3-D2B1889BAA87",
"versionEndExcluding": "1.2.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:g611_firmware:1.2.2:-:*:*:*:*:*:*",
"matchCriteriaId": "5FF584E3-70F0-4B05-857B-CE07D87BA130",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:g611:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D4BA74E1-BDA0-4FDD-820A-8DE32EEE2AA7",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:g36_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EB884461-7A80-44B0-A200-25D7E0EB5152",
"versionEndExcluding": "1.1.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:g36_firmware:1.1.4:-:*:*:*:*:*:*",
"matchCriteriaId": "BDA7D066-8443-4D6F-8E22-A0845236B490",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:g36:-:*:*:*:*:*:*:*",
"matchCriteriaId": "153073B7-9FBD-47D0-A1AB-CEE323AE5512",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er7212pc_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6CE877B8-E287-4FE6-84D5-666FE27AC9A6",
"versionEndExcluding": "2.1.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er7212pc_firmware:2.1.3:-:*:*:*:*:*:*",
"matchCriteriaId": "24860FF1-7CA9-47D4-90B6-CB8915F1D992",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er7212pc:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F300A161-E1A3-469E-9DE3-9B052F6BA8AC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E1BC6D9F-A556-468A-8770-6A39F09F26D6",
"versionEndExcluding": "1.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er706w-4g_firmware:1.2.1:-:*:*:*:*:*:*",
"matchCriteriaId": "96944BD2-388F-4CF6-BFD3-473EE6624F74",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er706w-4g:-:*:*:*:*:*:*:*",
"matchCriteriaId": "559FA8D2-3055-41CB-81A4-A7996D93588D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er706w_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "47273FE0-6E22-437E-B27F-058456E7602A",
"versionEndExcluding": "1.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er706w_firmware:1.2.1:-:*:*:*:*:*:*",
"matchCriteriaId": "AC30DFD7-30FD-482C-B8EF-9DDB98E269BF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er706w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7D599C4B-4A58-45EC-BA17-332FBF6E9805",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er605_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8EA51B29-39FB-4880-979B-3F612DE9D202",
"versionEndExcluding": "2.3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er605_firmware:2.3.1:-:*:*:*:*:*:*",
"matchCriteriaId": "1D1D1C14-E0F9-430D-BAC5-4F0C7287FD26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er605:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9892BC7C-6EA7-469B-AD26-6E5093DB5AB2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er7206_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AF595A8A-72CF-406E-BB0C-B76FDD51150B",
"versionEndExcluding": "2.2.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er7206_firmware:2.2.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8F66B05E-0D03-4B59-BCA3-7A2F40F092EE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er7206:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB65324D-FD72-4C28-92AF-85BFF1E8A993",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er707-m2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "48EDBC5B-BA54-4D11-9391-4FA7C7D4F5E7",
"versionEndExcluding": "1.3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er707-m2_firmware:1.3.1:-:*:*:*:*:*:*",
"matchCriteriaId": "359ADA2C-F1A5-4840-8F84-2DBA8F4573C4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er707-m2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E45AF81F-1346-4FD8-9E38-CAB330D79AB6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er7412-m2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "14CE8275-E546-4598-901C-F52355DED3C9",
"versionEndExcluding": "1.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er7412-m2_firmware:1.1.0:-:*:*:*:*:*:*",
"matchCriteriaId": "B79E0763-6D6F-4E59-91FC-D397A8BEF0F1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er7412-m2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FBB89DAE-6264-4F26-B34A-E1B84FB927D4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er8411_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EE0D8327-33EE-4EF0-BC2F-F2A16D55762A",
"versionEndExcluding": "1.3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er8411_firmware:1.3.3:-:*:*:*:*:*:*",
"matchCriteriaId": "6DB13EF6-0930-4575-92DC-AF431B2A2CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er8411:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4F2F16D8-5D7B-4E01-8BB3-F324B6011F72",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways."
}
],
"id": "CVE-2025-7851",
"lastModified": "2025-10-24T17:15:43.390",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"type": "Secondary"
}
]
},
"published": "2025-10-21T01:15:37.330",
"references": [
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Vendor Advisory"
],
"url": "https://support.omadanetworks.com/en/document/108456/"
},
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"url": "https://www.forescout.com/blog/new-tp-link-router-vulnerabilities-a-primer-on-rooting-routers/"
},
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Product"
],
"url": "https://www.omadanetworks.com/us/business-networking/all-omada-router/"
},
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Product"
],
"url": "https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/"
},
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Product"
],
"url": "https://www.tp-link.com/us/business-networking/soho-festa-gateway/"
}
],
"sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-269"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
FKIE_CVE-2025-6541
Vulnerability from fkie_nvd - Published: 2025-10-21 01:15 - Updated: 2025-10-24 13:45
Severity ?
Summary
An arbitrary OS command may be executed on the product by the user who can log in to the web management interface.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tp-link | er706w_firmware | * | |
| tp-link | er706w_firmware | 1.2.1 | |
| tp-link | er706w | - | |
| tp-link | er706w-4g_firmware | * | |
| tp-link | er706w-4g_firmware | 1.2.1 | |
| tp-link | er706w-4g | - | |
| tp-link | er7212pc_firmware | * | |
| tp-link | er7212pc_firmware | 2.1.3 | |
| tp-link | er7212pc | - | |
| tp-link | g36_firmware | * | |
| tp-link | g36_firmware | 1.1.4 | |
| tp-link | g36 | - | |
| tp-link | g611_firmware | * | |
| tp-link | g611_firmware | 1.2.2 | |
| tp-link | g611 | - | |
| tp-link | fr365_firmware | * | |
| tp-link | fr365_firmware | 1.1.10 | |
| tp-link | fr365 | - | |
| tp-link | fr205_firmware | * | |
| tp-link | fr205_firmware | 1.0.3 | |
| tp-link | fr205 | - | |
| tp-link | fr307-m2_firmware | * | |
| tp-link | fr307-m2_firmware | 1.2.5 | |
| tp-link | fr307-m2 | - | |
| tp-link | er8411_firmware | * | |
| tp-link | er8411_firmware | 1.3.3 | |
| tp-link | er8411 | - | |
| tp-link | er7412-m2_firmware | * | |
| tp-link | er7412-m2_firmware | 1.1.0 | |
| tp-link | er7412-m2 | - | |
| tp-link | er707-m2_firmware | * | |
| tp-link | er707-m2_firmware | 1.3.1 | |
| tp-link | er707-m2 | - | |
| tp-link | er7206_firmware | * | |
| tp-link | er7206_firmware | 2.2.2 | |
| tp-link | er7206 | - | |
| tp-link | er605_firmware | * | |
| tp-link | er605_firmware | 2.3.1 | |
| tp-link | er605 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er706w_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "47273FE0-6E22-437E-B27F-058456E7602A",
"versionEndExcluding": "1.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er706w_firmware:1.2.1:-:*:*:*:*:*:*",
"matchCriteriaId": "AC30DFD7-30FD-482C-B8EF-9DDB98E269BF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er706w:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7D599C4B-4A58-45EC-BA17-332FBF6E9805",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E1BC6D9F-A556-468A-8770-6A39F09F26D6",
"versionEndExcluding": "1.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er706w-4g_firmware:1.2.1:-:*:*:*:*:*:*",
"matchCriteriaId": "96944BD2-388F-4CF6-BFD3-473EE6624F74",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er706w-4g:-:*:*:*:*:*:*:*",
"matchCriteriaId": "559FA8D2-3055-41CB-81A4-A7996D93588D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er7212pc_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6CE877B8-E287-4FE6-84D5-666FE27AC9A6",
"versionEndExcluding": "2.1.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er7212pc_firmware:2.1.3:-:*:*:*:*:*:*",
"matchCriteriaId": "24860FF1-7CA9-47D4-90B6-CB8915F1D992",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er7212pc:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F300A161-E1A3-469E-9DE3-9B052F6BA8AC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:g36_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EB884461-7A80-44B0-A200-25D7E0EB5152",
"versionEndExcluding": "1.1.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:g36_firmware:1.1.4:-:*:*:*:*:*:*",
"matchCriteriaId": "BDA7D066-8443-4D6F-8E22-A0845236B490",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:g36:-:*:*:*:*:*:*:*",
"matchCriteriaId": "153073B7-9FBD-47D0-A1AB-CEE323AE5512",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:g611_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6F8E98F-0C86-40C0-BBD3-D2B1889BAA87",
"versionEndExcluding": "1.2.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:g611_firmware:1.2.2:-:*:*:*:*:*:*",
"matchCriteriaId": "5FF584E3-70F0-4B05-857B-CE07D87BA130",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:g611:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D4BA74E1-BDA0-4FDD-820A-8DE32EEE2AA7",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:fr365_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D38B9DBD-3397-40B8-B4A5-C1E0C248C300",
"versionEndExcluding": "1.1.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:fr365_firmware:1.1.10:-:*:*:*:*:*:*",
"matchCriteriaId": "4DA30139-EBED-40FD-BA20-CED14607B648",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:fr365:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB3D95C-C64A-48A6-8D13-E158CFB3CC7C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:fr205_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7FC1549-BC5C-45CF-8524-6DFFB4193D1B",
"versionEndExcluding": "1.0.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:fr205_firmware:1.0.3:-:*:*:*:*:*:*",
"matchCriteriaId": "532C5C8D-3AC4-4596-8D8C-6855686BD92A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:fr205:-:*:*:*:*:*:*:*",
"matchCriteriaId": "56799602-9EF3-47D5-86CC-9AA2AE3013CF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:fr307-m2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6952617F-CF3F-4EB4-89B3-0C7076EEEEBC",
"versionEndExcluding": "1.2.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:fr307-m2_firmware:1.2.5:-:*:*:*:*:*:*",
"matchCriteriaId": "5FDFE511-0244-454D-8D3F-C7E46D499FC5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:fr307-m2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2559CDDD-2C81-49A8-BF42-B3F6AC68F5F0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er8411_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EE0D8327-33EE-4EF0-BC2F-F2A16D55762A",
"versionEndExcluding": "1.3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er8411_firmware:1.3.3:-:*:*:*:*:*:*",
"matchCriteriaId": "6DB13EF6-0930-4575-92DC-AF431B2A2CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er8411:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4F2F16D8-5D7B-4E01-8BB3-F324B6011F72",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er7412-m2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "14CE8275-E546-4598-901C-F52355DED3C9",
"versionEndExcluding": "1.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er7412-m2_firmware:1.1.0:-:*:*:*:*:*:*",
"matchCriteriaId": "B79E0763-6D6F-4E59-91FC-D397A8BEF0F1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er7412-m2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FBB89DAE-6264-4F26-B34A-E1B84FB927D4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er707-m2_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "48EDBC5B-BA54-4D11-9391-4FA7C7D4F5E7",
"versionEndExcluding": "1.3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er707-m2_firmware:1.3.1:-:*:*:*:*:*:*",
"matchCriteriaId": "359ADA2C-F1A5-4840-8F84-2DBA8F4573C4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er707-m2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E45AF81F-1346-4FD8-9E38-CAB330D79AB6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er7206_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AF595A8A-72CF-406E-BB0C-B76FDD51150B",
"versionEndExcluding": "2.2.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er7206_firmware:2.2.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8F66B05E-0D03-4B59-BCA3-7A2F40F092EE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er7206:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB65324D-FD72-4C28-92AF-85BFF1E8A993",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er605_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8EA51B29-39FB-4880-979B-3F612DE9D202",
"versionEndExcluding": "2.3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:er605_firmware:2.3.1:-:*:*:*:*:*:*",
"matchCriteriaId": "1D1D1C14-E0F9-430D-BAC5-4F0C7287FD26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er605:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9892BC7C-6EA7-469B-AD26-6E5093DB5AB2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An arbitrary OS command may be executed on the product by the user who can log in to the web management interface."
}
],
"id": "CVE-2025-6541",
"lastModified": "2025-10-24T13:45:38.010",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"type": "Secondary"
}
]
},
"published": "2025-10-21T01:15:36.103",
"references": [
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Vendor Advisory"
],
"url": "https://support.omadanetworks.com/en/document/108455/"
},
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Product"
],
"url": "https://www.omadanetworks.com/us/business-networking/all-omada-router/"
},
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Product"
],
"url": "https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/"
},
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Product"
],
"url": "https://www.tp-link.com/us/business-networking/soho-festa-gateway/"
}
],
"sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"type": "Secondary"
}
]
}
FKIE_CVE-2024-21827
Vulnerability from fkie_nvd - Published: 2024-06-25 14:15 - Updated: 2025-11-04 18:15
Severity ?
Summary
A leftover debug code vulnerability exists in the cli_server debug functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.4.1 Build 20240117 Rel.57421. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tp-link | er7206_firmware | 1.4.1 | |
| tp-link | er7206 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er7206_firmware:1.4.1:build_20240117_rel_57421:*:*:*:*:*:*",
"matchCriteriaId": "E21970CA-738A-4D2D-92F4-51C56B365A7A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er7206:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB65324D-FD72-4C28-92AF-85BFF1E8A993",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A leftover debug code vulnerability exists in the cli_server debug functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.4.1 Build 20240117 Rel.57421. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de c\u00f3digo de depuraci\u00f3n sobrante en la funcionalidad de depuraci\u00f3n cli_server del enrutador VPN Tp-Link ER7206 Omada Gigabit 1.4.1 Build 20240117 Rel.57421. Una serie de solicitudes de red especialmente manipuladas pueden provocar la ejecuci\u00f3n de comandos arbitrarios. Un atacante puede enviar una secuencia de solicitudes para desencadenar esta vulnerabilidad."
}
],
"id": "CVE-2024-21827",
"lastModified": "2025-11-04T18:15:50.580",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "talos-cna@cisco.com",
"type": "Secondary"
}
]
},
"published": "2024-06-25T14:15:10.940",
"references": [
{
"source": "talos-cna@cisco.com",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1947"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1947"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1947"
}
],
"sourceIdentifier": "talos-cna@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-489"
}
],
"source": "talos-cna@cisco.com",
"type": "Secondary"
}
]
}
FKIE_CVE-2023-47618
Vulnerability from fkie_nvd - Published: 2024-02-06 17:15 - Updated: 2025-11-04 19:16
Severity ?
Summary
A post authentication command execution vulnerability exists in the web filtering functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
References
| URL | Tags | ||
|---|---|---|---|
| talos-cna@cisco.com | https://talosintelligence.com/vulnerability_reports/TALOS-2023-1859 | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://talosintelligence.com/vulnerability_reports/TALOS-2023-1859 | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1859 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tp-link | er7206_firmware | 1.3.0 | |
| tp-link | er7206 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er7206_firmware:1.3.0:build_20230322_rel_70591:*:*:*:*:*:*",
"matchCriteriaId": "96429759-A111-4CB6-BB47-C258CFD5C301",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er7206:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB65324D-FD72-4C28-92AF-85BFF1E8A993",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A post authentication command execution vulnerability exists in the web filtering functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de ejecuci\u00f3n de comando posterior a la autenticaci\u00f3n en la funcionalidad de filtrado web de Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. Una solicitud HTTP especialmente manipulada puede provocar la ejecuci\u00f3n de un comando arbitrario. Un atacante puede realizar una solicitud HTTP autenticada para desencadenar esta vulnerabilidad."
}
],
"id": "CVE-2023-47618",
"lastModified": "2025-11-04T19:16:06.350",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "talos-cna@cisco.com",
"type": "Secondary"
}
]
},
"published": "2024-02-06T17:15:10.013",
"references": [
{
"source": "talos-cna@cisco.com",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1859"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1859"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1859"
}
],
"sourceIdentifier": "talos-cna@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "talos-cna@cisco.com",
"type": "Secondary"
}
]
}
FKIE_CVE-2023-46683
Vulnerability from fkie_nvd - Published: 2024-02-06 17:15 - Updated: 2025-11-04 19:16
Severity ?
Summary
A post authentication command injection vulnerability exists when configuring the wireguard VPN functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection . An attacker can make an authenticated HTTP request to trigger this vulnerability.
References
| URL | Tags | ||
|---|---|---|---|
| talos-cna@cisco.com | https://talosintelligence.com/vulnerability_reports/TALOS-2023-1857 | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://talosintelligence.com/vulnerability_reports/TALOS-2023-1857 | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1857 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tp-link | er7206_firmware | 1.3.0 | |
| tp-link | er7206 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er7206_firmware:1.3.0:build_20230322_rel_70591:*:*:*:*:*:*",
"matchCriteriaId": "96429759-A111-4CB6-BB47-C258CFD5C301",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er7206:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB65324D-FD72-4C28-92AF-85BFF1E8A993",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A post authentication command injection vulnerability exists when configuring the wireguard VPN functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection . An attacker can make an authenticated HTTP request to trigger this vulnerability."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de inyecci\u00f3n de comando posterior a la autenticaci\u00f3n al configurar la funcionalidad VPN de protecci\u00f3n de cables de Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. Una solicitud HTTP especialmente manipulada puede dar lugar a la inyecci\u00f3n de comandos arbitrarios. Un atacante puede realizar una solicitud HTTP autenticada para desencadenar esta vulnerabilidad."
}
],
"id": "CVE-2023-46683",
"lastModified": "2025-11-04T19:16:04.423",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "talos-cna@cisco.com",
"type": "Secondary"
}
]
},
"published": "2024-02-06T17:15:09.180",
"references": [
{
"source": "talos-cna@cisco.com",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1857"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1857"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1857"
}
],
"sourceIdentifier": "talos-cna@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "talos-cna@cisco.com",
"type": "Secondary"
}
]
}
FKIE_CVE-2023-47167
Vulnerability from fkie_nvd - Published: 2024-02-06 17:15 - Updated: 2025-11-04 19:16
Severity ?
Summary
A post authentication command injection vulnerability exists in the GRE policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
References
| URL | Tags | ||
|---|---|---|---|
| talos-cna@cisco.com | https://talosintelligence.com/vulnerability_reports/TALOS-2023-1855 | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://talosintelligence.com/vulnerability_reports/TALOS-2023-1855 | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1855 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tp-link | er7206_firmware | 1.3.0 | |
| tp-link | er7206 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er7206_firmware:1.3.0:build_20230322_rel_70591:*:*:*:*:*:*",
"matchCriteriaId": "96429759-A111-4CB6-BB47-C258CFD5C301",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er7206:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB65324D-FD72-4C28-92AF-85BFF1E8A993",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A post authentication command injection vulnerability exists in the GRE policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de inyecci\u00f3n de comando posterior a la autenticaci\u00f3n en la funcionalidad de pol\u00edtica GRE de Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. Una solicitud HTTP especialmente manipulada puede dar lugar a la inyecci\u00f3n de comandos arbitrarios. Un atacante puede realizar una solicitud HTTP autenticada para desencadenar esta vulnerabilidad."
}
],
"id": "CVE-2023-47167",
"lastModified": "2025-11-04T19:16:05.753",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "talos-cna@cisco.com",
"type": "Secondary"
}
]
},
"published": "2024-02-06T17:15:09.380",
"references": [
{
"source": "talos-cna@cisco.com",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1855"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1855"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1855"
}
],
"sourceIdentifier": "talos-cna@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "talos-cna@cisco.com",
"type": "Secondary"
}
]
}
FKIE_CVE-2023-47209
Vulnerability from fkie_nvd - Published: 2024-02-06 17:15 - Updated: 2025-11-04 19:16
Severity ?
Summary
A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
References
| URL | Tags | ||
|---|---|---|---|
| talos-cna@cisco.com | https://talosintelligence.com/vulnerability_reports/TALOS-2023-1854 | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://talosintelligence.com/vulnerability_reports/TALOS-2023-1854 | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1854 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tp-link | er7206_firmware | 1.3.0 | |
| tp-link | er7206 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er7206_firmware:1.3.0:build_20230322_rel_70591:*:*:*:*:*:*",
"matchCriteriaId": "96429759-A111-4CB6-BB47-C258CFD5C301",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er7206:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB65324D-FD72-4C28-92AF-85BFF1E8A993",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de inyecci\u00f3n de comando posterior a la autenticaci\u00f3n en la funcionalidad de pol\u00edtica ipsec de Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. Una solicitud HTTP especialmente manipulada puede dar lugar a la inyecci\u00f3n de comandos arbitrarios. Un atacante puede realizar una solicitud HTTP autenticada para desencadenar esta vulnerabilidad."
}
],
"id": "CVE-2023-47209",
"lastModified": "2025-11-04T19:16:05.980",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "talos-cna@cisco.com",
"type": "Secondary"
}
]
},
"published": "2024-02-06T17:15:09.593",
"references": [
{
"source": "talos-cna@cisco.com",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1854"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1854"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1854"
}
],
"sourceIdentifier": "talos-cna@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "talos-cna@cisco.com",
"type": "Secondary"
}
]
}
FKIE_CVE-2023-47617
Vulnerability from fkie_nvd - Published: 2024-02-06 17:15 - Updated: 2025-11-04 19:16
Severity ?
Summary
A post authentication command injection vulnerability exists when configuring the web group member of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
References
| URL | Tags | ||
|---|---|---|---|
| talos-cna@cisco.com | https://talosintelligence.com/vulnerability_reports/TALOS-2023-1858 | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://talosintelligence.com/vulnerability_reports/TALOS-2023-1858 | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1858 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tp-link | er7206_firmware | 1.3.0 | |
| tp-link | er7206 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er7206_firmware:1.3.0:build_20230322_rel_70591:*:*:*:*:*:*",
"matchCriteriaId": "96429759-A111-4CB6-BB47-C258CFD5C301",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er7206:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB65324D-FD72-4C28-92AF-85BFF1E8A993",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A post authentication command injection vulnerability exists when configuring the web group member of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de inyecci\u00f3n de comando posterior a la autenticaci\u00f3n al configurar el miembro del grupo web de Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. Una solicitud HTTP especialmente manipulada puede dar lugar a la inyecci\u00f3n de comandos arbitrarios. Un atacante puede realizar una solicitud HTTP autenticada para desencadenar esta vulnerabilidad."
}
],
"id": "CVE-2023-47617",
"lastModified": "2025-11-04T19:16:06.223",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "talos-cna@cisco.com",
"type": "Secondary"
}
]
},
"published": "2024-02-06T17:15:09.797",
"references": [
{
"source": "talos-cna@cisco.com",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1858"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1858"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1858"
}
],
"sourceIdentifier": "talos-cna@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "talos-cna@cisco.com",
"type": "Secondary"
}
]
}
FKIE_CVE-2023-42664
Vulnerability from fkie_nvd - Published: 2024-02-06 17:15 - Updated: 2025-11-04 19:15
Severity ?
Summary
A post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
References
| URL | Tags | ||
|---|---|---|---|
| talos-cna@cisco.com | https://talosintelligence.com/vulnerability_reports/TALOS-2023-1856 | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://talosintelligence.com/vulnerability_reports/TALOS-2023-1856 | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1856 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tp-link | er7206_firmware | 1.3.0 | |
| tp-link | er7206 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er7206_firmware:1.3.0:build_20230322_rel_70591:*:*:*:*:*:*",
"matchCriteriaId": "96429759-A111-4CB6-BB47-C258CFD5C301",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er7206:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB65324D-FD72-4C28-92AF-85BFF1E8A993",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de inyecci\u00f3n de comando posterior a la autenticaci\u00f3n al configurar la configuraci\u00f3n global PPTP de Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. Una solicitud HTTP especialmente manipulada puede dar lugar a la inyecci\u00f3n de comandos arbitrarios. Un atacante puede realizar una solicitud HTTP autenticada para desencadenar esta vulnerabilidad."
}
],
"id": "CVE-2023-42664",
"lastModified": "2025-11-04T19:15:57.590",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "talos-cna@cisco.com",
"type": "Secondary"
}
]
},
"published": "2024-02-06T17:15:08.770",
"references": [
{
"source": "talos-cna@cisco.com",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1856"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1856"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1856"
}
],
"sourceIdentifier": "talos-cna@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "talos-cna@cisco.com",
"type": "Secondary"
}
]
}
FKIE_CVE-2023-36498
Vulnerability from fkie_nvd - Published: 2024-02-06 17:15 - Updated: 2025-11-04 19:15
Severity ?
Summary
A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability and gain access to an unrestricted shell.
References
| URL | Tags | ||
|---|---|---|---|
| talos-cna@cisco.com | https://talosintelligence.com/vulnerability_reports/TALOS-2023-1853 | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://talosintelligence.com/vulnerability_reports/TALOS-2023-1853 | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1853 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tp-link | er7206_firmware | 1.3.0 | |
| tp-link | er7206 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er7206_firmware:1.3.0:build_20230322_rel_70591:*:*:*:*:*:*",
"matchCriteriaId": "96429759-A111-4CB6-BB47-C258CFD5C301",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er7206:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB65324D-FD72-4C28-92AF-85BFF1E8A993",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability and gain access to an unrestricted shell."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de inyecci\u00f3n de comando posterior a la autenticaci\u00f3n en la funcionalidad del cliente PPTP de Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. Una solicitud HTTP especialmente manipulada puede dar lugar a la inyecci\u00f3n de comandos arbitrarios. Un atacante puede realizar una solicitud HTTP autenticada para activar esta vulnerabilidad y obtener acceso a un shell sin restricciones."
}
],
"id": "CVE-2023-36498",
"lastModified": "2025-11-04T19:15:46.107",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "talos-cna@cisco.com",
"type": "Secondary"
}
]
},
"published": "2024-02-06T17:15:08.527",
"references": [
{
"source": "talos-cna@cisco.com",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1853"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1853"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1853"
}
],
"sourceIdentifier": "talos-cna@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "talos-cna@cisco.com",
"type": "Secondary"
}
]
}
FKIE_CVE-2023-43482
Vulnerability from fkie_nvd - Published: 2024-02-06 17:15 - Updated: 2025-11-04 19:15
Severity ?
Summary
A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
References
| URL | Tags | ||
|---|---|---|---|
| talos-cna@cisco.com | https://talosintelligence.com/vulnerability_reports/TALOS-2023-1850 | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://talosintelligence.com/vulnerability_reports/TALOS-2023-1850 | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1850 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tp-link | er7206_firmware | 1.3.0 | |
| tp-link | er7206 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:er7206_firmware:1.3.0:build_20230322_rel_70591:*:*:*:*:*:*",
"matchCriteriaId": "96429759-A111-4CB6-BB47-C258CFD5C301",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:er7206:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB65324D-FD72-4C28-92AF-85BFF1E8A993",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de ejecuci\u00f3n de comandos en la funcionalidad de recursos invitados de Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. Una solicitud HTTP especialmente manipulada puede provocar la ejecuci\u00f3n de un comando arbitrario. Un atacante puede realizar una solicitud HTTP autenticada para desencadenar esta vulnerabilidad."
}
],
"id": "CVE-2023-43482",
"lastModified": "2025-11-04T19:15:59.347",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "talos-cna@cisco.com",
"type": "Secondary"
}
]
},
"published": "2024-02-06T17:15:08.973",
"references": [
{
"source": "talos-cna@cisco.com",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1850"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1850"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1850"
}
],
"sourceIdentifier": "talos-cna@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "talos-cna@cisco.com",
"type": "Secondary"
}
]
}
CVE-2025-7851 (GCVE-0-2025-7851)
Vulnerability from cvelistv5 – Published: 2025-10-21 00:29 – Updated: 2025-10-24 17:00
VLAI?
Summary
An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.
Severity ?
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TP-Link Systems Inc. | Omada gateways |
Affected:
0 , < ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3
(Firmware)
|
||||||||||||
|
||||||||||||||
Credits
Stanislav Dashevskyi and Francesco La Spina of Forescout
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-7851",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-21T14:07:19.825502Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T14:07:59.499Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Omada gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Festa gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "FR365 1.1.10, FR205 1.0.3, FR307 1.2.5",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Pro gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "G36 1.1.4, G611 1.2.2",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Stanislav Dashevskyi and Francesco La Spina of Forescout"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eAn attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-24T17:00:06.753Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.omadanetworks.com/en/document/108456/"
},
{
"tags": [
"product"
],
"url": "https://www.omadanetworks.com/us/business-networking/all-omada-router/"
},
{
"tags": [
"product"
],
"url": "https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/"
},
{
"tags": [
"product"
],
"url": "https://www.tp-link.com/us/business-networking/soho-festa-gateway/"
},
{
"url": "https://www.forescout.com/blog/new-tp-link-router-vulnerabilities-a-primer-on-rooting-routers/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthorized root access via debug functionality",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2025-7851",
"datePublished": "2025-10-21T00:29:05.809Z",
"dateReserved": "2025-07-18T21:49:12.159Z",
"dateUpdated": "2025-10-24T17:00:06.753Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-7850 (GCVE-0-2025-7850)
Vulnerability from cvelistv5 – Published: 2025-10-21 00:28 – Updated: 2025-10-24 16:59
VLAI?
Summary
A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.
Severity ?
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TP-Link Systems Inc. | Omada gateways |
Affected:
0 , < ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3
(Firmware)
|
||||||||||||
|
||||||||||||||
Credits
Stanislav Dashevskyi and Francesco La Spina of Forescout
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-7850",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-21T14:09:38.276316Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T14:10:11.876Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Omada gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Festa gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "FR365 1.1.10, FR205 1.0.3, FR307 1.2.5",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Pro gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "G36 1.1.4, G611 1.2.2",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Stanislav Dashevskyi and Francesco La Spina of Forescout"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eA command injection vulnerability may be exploited after the admin\u0027s authentication on the web portal on Omada gateways.\u003cbr\u003e\u003c/div\u003e"
}
],
"value": "A command injection vulnerability may be exploited after the admin\u0027s authentication on the web portal on Omada gateways."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-24T16:59:25.310Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.omadanetworks.com/en/document/108456/"
},
{
"tags": [
"product"
],
"url": "https://www.omadanetworks.com/us/business-networking/all-omada-router/"
},
{
"tags": [
"product"
],
"url": "https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/"
},
{
"tags": [
"product"
],
"url": "https://www.tp-link.com/us/business-networking/soho-festa-gateway/"
},
{
"url": "https://www.forescout.com/blog/new-tp-link-router-vulnerabilities-a-primer-on-rooting-routers/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated OS command execution",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2025-7850",
"datePublished": "2025-10-21T00:28:11.589Z",
"dateReserved": "2025-07-18T21:49:10.486Z",
"dateUpdated": "2025-10-24T16:59:25.310Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-6542 (GCVE-0-2025-6542)
Vulnerability from cvelistv5 – Published: 2025-10-21 00:23 – Updated: 2025-10-21 14:15
VLAI?
Summary
An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.
Severity ?
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TP-Link Systems Inc. | Omada gateways |
Affected:
0 , < ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3
(Firmware)
|
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-6542",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-21T14:14:50.370895Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T14:15:13.774Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Omada gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Festa gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "FR365 1.1.10, FR205 1.0.3, FR307 1.2.5",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Pro gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "G36 1.1.4, G611 1.2.2",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An arbitrary OS command may be executed on the product by a remote unauthenticated attacker."
}
],
"value": "An arbitrary OS command may be executed on the product by a remote unauthenticated attacker."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T01:16:09.887Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.omadanetworks.com/en/document/108455/"
},
{
"tags": [
"product"
],
"url": "https://www.omadanetworks.com/us/business-networking/all-omada-router/"
},
{
"tags": [
"product"
],
"url": "https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/"
},
{
"tags": [
"product"
],
"url": "https://www.tp-link.com/us/business-networking/soho-festa-gateway/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "OS command injection in multiple parameters",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2025-6542",
"datePublished": "2025-10-21T00:23:08.908Z",
"dateReserved": "2025-06-23T17:48:10.419Z",
"dateUpdated": "2025-10-21T14:15:13.774Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-6541 (GCVE-0-2025-6541)
Vulnerability from cvelistv5 – Published: 2025-10-21 00:21 – Updated: 2025-10-21 13:57
VLAI?
Summary
An arbitrary OS command may be executed on the product by the user who can log in to the web management interface.
Severity ?
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TP-Link Systems Inc. | Omada gateways |
Affected:
0 , < ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3
(Firmware)
|
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-6541",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-21T13:56:36.534414Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T13:57:51.728Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Omada gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Festa gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "FR365 1.1.10, FR205 1.0.3, FR307 1.2.5",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Pro gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "G36 1.1.4, G611 1.2.2",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An arbitrary OS command may be executed on the product by the user who can log in to the web management interface."
}
],
"value": "An arbitrary OS command may be executed on the product by the user who can log in to the web management interface."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T00:21:42.535Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.omadanetworks.com/en/document/108455/"
},
{
"tags": [
"product"
],
"url": "https://www.omadanetworks.com/us/business-networking/all-omada-router/"
},
{
"tags": [
"product"
],
"url": "https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/"
},
{
"tags": [
"product"
],
"url": "https://www.tp-link.com/us/business-networking/soho-festa-gateway/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "OS command injection using information obtained from the web management interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2025-6541",
"datePublished": "2025-10-21T00:21:42.535Z",
"dateReserved": "2025-06-23T17:48:07.425Z",
"dateUpdated": "2025-10-21T13:57:51.728Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-21827 (GCVE-0-2024-21827)
Vulnerability from cvelistv5 – Published: 2024-06-25 14:01 – Updated: 2025-11-04 17:14
VLAI?
Summary
A leftover debug code vulnerability exists in the cli_server debug functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.4.1 Build 20240117 Rel.57421. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.
Severity ?
7.2 (High)
CWE
- CWE-489 - Leftover Debug Code
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Tp-Link | ER7206 Omada Gigabit VPN Router |
Affected:
1.4.1 Build 20240117 Rel.57421
|
Credits
Discovered by the Vulnerability Discovery and Research team of Cisco Talos.
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:tp-link:er7206:1.4.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "er7206",
"vendor": "tp-link",
"versions": [
{
"status": "affected",
"version": "1.4.1"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-21827",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-28T03:55:30.451509Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T13:04:19.580Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T17:14:15.827Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1947",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1947"
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1947"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ER7206 Omada Gigabit VPN Router",
"vendor": "Tp-Link",
"versions": [
{
"status": "affected",
"version": "1.4.1 Build 20240117 Rel.57421"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by the Vulnerability Discovery and Research team of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A leftover debug code vulnerability exists in the cli_server debug functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.4.1 Build 20240117 Rel.57421. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-489",
"description": "CWE-489: Leftover Debug Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-25T17:00:06.591Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1947",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1947"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2024-21827",
"datePublished": "2024-06-25T14:01:26.644Z",
"dateReserved": "2024-02-14T16:25:03.146Z",
"dateUpdated": "2025-11-04T17:14:15.827Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-43482 (GCVE-0-2023-43482)
Vulnerability from cvelistv5 – Published: 2024-02-06 16:20 – Updated: 2025-11-04 18:17
VLAI?
Summary
A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Severity ?
7.2 (High)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Tp-Link | ER7206 Omada Gigabit VPN Router |
Affected:
1.3.0 build 20230322 Rel.70591
|
Credits
Discovered by the Vulnerability Discovery and Research team of Cisco Talos.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-04T18:17:24.956Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1850",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1850"
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1850"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-43482",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-08T15:35:36.297618Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-15T19:44:01.375Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ER7206 Omada Gigabit VPN Router",
"vendor": "Tp-Link",
"versions": [
{
"status": "affected",
"version": "1.3.0 build 20230322 Rel.70591"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by the Vulnerability Discovery and Research team of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-06T18:00:06.919Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1850",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1850"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-43482",
"datePublished": "2024-02-06T16:20:15.812Z",
"dateReserved": "2023-11-07T15:29:19.779Z",
"dateUpdated": "2025-11-04T18:17:24.956Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-36498 (GCVE-0-2023-36498)
Vulnerability from cvelistv5 – Published: 2024-02-06 16:20 – Updated: 2025-11-04 18:15
VLAI?
Summary
A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability and gain access to an unrestricted shell.
Severity ?
7.2 (High)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Tp-Link | ER7206 Omada Gigabit VPN Router |
Affected:
1.3.0 build 20230322 Rel.70591
|
Credits
Discovered by the Vulnerability Discovery and Research team of Cisco Talos.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-36498",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-21T19:52:18.748728Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:25:48.774Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T18:15:13.723Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1853",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1853"
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1853"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ER7206 Omada Gigabit VPN Router",
"vendor": "Tp-Link",
"versions": [
{
"status": "affected",
"version": "1.3.0 build 20230322 Rel.70591"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by the Vulnerability Discovery and Research team of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability and gain access to an unrestricted shell."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-06T18:00:08.219Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1853",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1853"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-36498",
"datePublished": "2024-02-06T16:20:15.386Z",
"dateReserved": "2023-11-07T22:57:30.277Z",
"dateUpdated": "2025-11-04T18:15:13.723Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-47209 (GCVE-0-2023-47209)
Vulnerability from cvelistv5 – Published: 2024-02-06 16:20 – Updated: 2025-11-04 18:19
VLAI?
Summary
A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Severity ?
7.2 (High)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Tp-Link | ER7206 Omada Gigabit VPN Router |
Affected:
1.3.0 build 20230322 Rel.70591
|
Credits
Discovered by the Vulnerability Discovery and Research team of Cisco Talos.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-04T18:19:02.658Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1854",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1854"
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1854"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-47209",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-09T16:24:49.242204Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-09T16:25:32.088Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ER7206 Omada Gigabit VPN Router",
"vendor": "Tp-Link",
"versions": [
{
"status": "affected",
"version": "1.3.0 build 20230322 Rel.70591"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by the Vulnerability Discovery and Research team of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-06T18:00:07.426Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1854",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1854"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-47209",
"datePublished": "2024-02-06T16:20:14.973Z",
"dateReserved": "2023-11-07T23:01:22.011Z",
"dateUpdated": "2025-11-04T18:19:02.658Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-47167 (GCVE-0-2023-47167)
Vulnerability from cvelistv5 – Published: 2024-02-06 16:20 – Updated: 2025-11-04 18:18
VLAI?
Summary
A post authentication command injection vulnerability exists in the GRE policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Severity ?
7.2 (High)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Tp-Link | ER7206 Omada Gigabit VPN Router |
Affected:
1.3.0 build 20230322 Rel.70591
|
Credits
Discovered by the Vulnerability Discovery and Research team of Cisco Talos.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-04T18:18:59.988Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1855",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1855"
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1855"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:tp-link:er7206_firmware:1.3.0:build_20230322_rel_70591:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "er7206_firmware",
"vendor": "tp-link",
"versions": [
{
"status": "affected",
"version": "1.3.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-47167",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-19T20:24:47.240328Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-19T20:27:00.213Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ER7206 Omada Gigabit VPN Router",
"vendor": "Tp-Link",
"versions": [
{
"status": "affected",
"version": "1.3.0 build 20230322 Rel.70591"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by the Vulnerability Discovery and Research team of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A post authentication command injection vulnerability exists in the GRE policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-06T18:00:07.806Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1855",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1855"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-47167",
"datePublished": "2024-02-06T16:20:14.536Z",
"dateReserved": "2023-11-07T23:09:28.106Z",
"dateUpdated": "2025-11-04T18:18:59.988Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-7851 (GCVE-0-2025-7851)
Vulnerability from nvd – Published: 2025-10-21 00:29 – Updated: 2025-10-24 17:00
VLAI?
Summary
An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.
Severity ?
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TP-Link Systems Inc. | Omada gateways |
Affected:
0 , < ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3
(Firmware)
|
||||||||||||
|
||||||||||||||
Credits
Stanislav Dashevskyi and Francesco La Spina of Forescout
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-7851",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-21T14:07:19.825502Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T14:07:59.499Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Omada gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Festa gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "FR365 1.1.10, FR205 1.0.3, FR307 1.2.5",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Pro gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "G36 1.1.4, G611 1.2.2",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Stanislav Dashevskyi and Francesco La Spina of Forescout"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eAn attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-24T17:00:06.753Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.omadanetworks.com/en/document/108456/"
},
{
"tags": [
"product"
],
"url": "https://www.omadanetworks.com/us/business-networking/all-omada-router/"
},
{
"tags": [
"product"
],
"url": "https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/"
},
{
"tags": [
"product"
],
"url": "https://www.tp-link.com/us/business-networking/soho-festa-gateway/"
},
{
"url": "https://www.forescout.com/blog/new-tp-link-router-vulnerabilities-a-primer-on-rooting-routers/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthorized root access via debug functionality",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2025-7851",
"datePublished": "2025-10-21T00:29:05.809Z",
"dateReserved": "2025-07-18T21:49:12.159Z",
"dateUpdated": "2025-10-24T17:00:06.753Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-7850 (GCVE-0-2025-7850)
Vulnerability from nvd – Published: 2025-10-21 00:28 – Updated: 2025-10-24 16:59
VLAI?
Summary
A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.
Severity ?
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TP-Link Systems Inc. | Omada gateways |
Affected:
0 , < ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3
(Firmware)
|
||||||||||||
|
||||||||||||||
Credits
Stanislav Dashevskyi and Francesco La Spina of Forescout
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-7850",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-21T14:09:38.276316Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T14:10:11.876Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Omada gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Festa gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "FR365 1.1.10, FR205 1.0.3, FR307 1.2.5",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Pro gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "G36 1.1.4, G611 1.2.2",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Stanislav Dashevskyi and Francesco La Spina of Forescout"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eA command injection vulnerability may be exploited after the admin\u0027s authentication on the web portal on Omada gateways.\u003cbr\u003e\u003c/div\u003e"
}
],
"value": "A command injection vulnerability may be exploited after the admin\u0027s authentication on the web portal on Omada gateways."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-24T16:59:25.310Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.omadanetworks.com/en/document/108456/"
},
{
"tags": [
"product"
],
"url": "https://www.omadanetworks.com/us/business-networking/all-omada-router/"
},
{
"tags": [
"product"
],
"url": "https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/"
},
{
"tags": [
"product"
],
"url": "https://www.tp-link.com/us/business-networking/soho-festa-gateway/"
},
{
"url": "https://www.forescout.com/blog/new-tp-link-router-vulnerabilities-a-primer-on-rooting-routers/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated OS command execution",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2025-7850",
"datePublished": "2025-10-21T00:28:11.589Z",
"dateReserved": "2025-07-18T21:49:10.486Z",
"dateUpdated": "2025-10-24T16:59:25.310Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-6542 (GCVE-0-2025-6542)
Vulnerability from nvd – Published: 2025-10-21 00:23 – Updated: 2025-10-21 14:15
VLAI?
Summary
An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.
Severity ?
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TP-Link Systems Inc. | Omada gateways |
Affected:
0 , < ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3
(Firmware)
|
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-6542",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-21T14:14:50.370895Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T14:15:13.774Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Omada gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Festa gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "FR365 1.1.10, FR205 1.0.3, FR307 1.2.5",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Pro gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "G36 1.1.4, G611 1.2.2",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An arbitrary OS command may be executed on the product by a remote unauthenticated attacker."
}
],
"value": "An arbitrary OS command may be executed on the product by a remote unauthenticated attacker."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T01:16:09.887Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.omadanetworks.com/en/document/108455/"
},
{
"tags": [
"product"
],
"url": "https://www.omadanetworks.com/us/business-networking/all-omada-router/"
},
{
"tags": [
"product"
],
"url": "https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/"
},
{
"tags": [
"product"
],
"url": "https://www.tp-link.com/us/business-networking/soho-festa-gateway/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "OS command injection in multiple parameters",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2025-6542",
"datePublished": "2025-10-21T00:23:08.908Z",
"dateReserved": "2025-06-23T17:48:10.419Z",
"dateUpdated": "2025-10-21T14:15:13.774Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-6541 (GCVE-0-2025-6541)
Vulnerability from nvd – Published: 2025-10-21 00:21 – Updated: 2025-10-21 13:57
VLAI?
Summary
An arbitrary OS command may be executed on the product by the user who can log in to the web management interface.
Severity ?
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TP-Link Systems Inc. | Omada gateways |
Affected:
0 , < ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3
(Firmware)
|
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-6541",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-21T13:56:36.534414Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T13:57:51.728Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Omada gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Festa gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "FR365 1.1.10, FR205 1.0.3, FR307 1.2.5",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Pro gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "G36 1.1.4, G611 1.2.2",
"status": "affected",
"version": "0",
"versionType": "Firmware"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An arbitrary OS command may be executed on the product by the user who can log in to the web management interface."
}
],
"value": "An arbitrary OS command may be executed on the product by the user who can log in to the web management interface."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T00:21:42.535Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.omadanetworks.com/en/document/108455/"
},
{
"tags": [
"product"
],
"url": "https://www.omadanetworks.com/us/business-networking/all-omada-router/"
},
{
"tags": [
"product"
],
"url": "https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/"
},
{
"tags": [
"product"
],
"url": "https://www.tp-link.com/us/business-networking/soho-festa-gateway/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "OS command injection using information obtained from the web management interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2025-6541",
"datePublished": "2025-10-21T00:21:42.535Z",
"dateReserved": "2025-06-23T17:48:07.425Z",
"dateUpdated": "2025-10-21T13:57:51.728Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-21827 (GCVE-0-2024-21827)
Vulnerability from nvd – Published: 2024-06-25 14:01 – Updated: 2025-11-04 17:14
VLAI?
Summary
A leftover debug code vulnerability exists in the cli_server debug functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.4.1 Build 20240117 Rel.57421. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.
Severity ?
7.2 (High)
CWE
- CWE-489 - Leftover Debug Code
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Tp-Link | ER7206 Omada Gigabit VPN Router |
Affected:
1.4.1 Build 20240117 Rel.57421
|
Credits
Discovered by the Vulnerability Discovery and Research team of Cisco Talos.
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:tp-link:er7206:1.4.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "er7206",
"vendor": "tp-link",
"versions": [
{
"status": "affected",
"version": "1.4.1"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-21827",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-28T03:55:30.451509Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T13:04:19.580Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T17:14:15.827Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1947",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1947"
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1947"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ER7206 Omada Gigabit VPN Router",
"vendor": "Tp-Link",
"versions": [
{
"status": "affected",
"version": "1.4.1 Build 20240117 Rel.57421"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by the Vulnerability Discovery and Research team of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A leftover debug code vulnerability exists in the cli_server debug functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.4.1 Build 20240117 Rel.57421. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-489",
"description": "CWE-489: Leftover Debug Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-25T17:00:06.591Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1947",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1947"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2024-21827",
"datePublished": "2024-06-25T14:01:26.644Z",
"dateReserved": "2024-02-14T16:25:03.146Z",
"dateUpdated": "2025-11-04T17:14:15.827Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-43482 (GCVE-0-2023-43482)
Vulnerability from nvd – Published: 2024-02-06 16:20 – Updated: 2025-11-04 18:17
VLAI?
Summary
A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Severity ?
7.2 (High)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Tp-Link | ER7206 Omada Gigabit VPN Router |
Affected:
1.3.0 build 20230322 Rel.70591
|
Credits
Discovered by the Vulnerability Discovery and Research team of Cisco Talos.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-04T18:17:24.956Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1850",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1850"
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1850"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-43482",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-08T15:35:36.297618Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-15T19:44:01.375Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ER7206 Omada Gigabit VPN Router",
"vendor": "Tp-Link",
"versions": [
{
"status": "affected",
"version": "1.3.0 build 20230322 Rel.70591"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by the Vulnerability Discovery and Research team of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-06T18:00:06.919Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1850",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1850"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-43482",
"datePublished": "2024-02-06T16:20:15.812Z",
"dateReserved": "2023-11-07T15:29:19.779Z",
"dateUpdated": "2025-11-04T18:17:24.956Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-36498 (GCVE-0-2023-36498)
Vulnerability from nvd – Published: 2024-02-06 16:20 – Updated: 2025-11-04 18:15
VLAI?
Summary
A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability and gain access to an unrestricted shell.
Severity ?
7.2 (High)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Tp-Link | ER7206 Omada Gigabit VPN Router |
Affected:
1.3.0 build 20230322 Rel.70591
|
Credits
Discovered by the Vulnerability Discovery and Research team of Cisco Talos.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-36498",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-21T19:52:18.748728Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:25:48.774Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-04T18:15:13.723Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1853",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1853"
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1853"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ER7206 Omada Gigabit VPN Router",
"vendor": "Tp-Link",
"versions": [
{
"status": "affected",
"version": "1.3.0 build 20230322 Rel.70591"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by the Vulnerability Discovery and Research team of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability and gain access to an unrestricted shell."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-06T18:00:08.219Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1853",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1853"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-36498",
"datePublished": "2024-02-06T16:20:15.386Z",
"dateReserved": "2023-11-07T22:57:30.277Z",
"dateUpdated": "2025-11-04T18:15:13.723Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-47209 (GCVE-0-2023-47209)
Vulnerability from nvd – Published: 2024-02-06 16:20 – Updated: 2025-11-04 18:19
VLAI?
Summary
A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Severity ?
7.2 (High)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Tp-Link | ER7206 Omada Gigabit VPN Router |
Affected:
1.3.0 build 20230322 Rel.70591
|
Credits
Discovered by the Vulnerability Discovery and Research team of Cisco Talos.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-04T18:19:02.658Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1854",
"tags": [
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1854"
},
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1854"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-47209",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-09T16:24:49.242204Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-09T16:25:32.088Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ER7206 Omada Gigabit VPN Router",
"vendor": "Tp-Link",
"versions": [
{
"status": "affected",
"version": "1.3.0 build 20230322 Rel.70591"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by the Vulnerability Discovery and Research team of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-06T18:00:07.426Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1854",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1854"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2023-47209",
"datePublished": "2024-02-06T16:20:14.973Z",
"dateReserved": "2023-11-07T23:01:22.011Z",
"dateUpdated": "2025-11-04T18:19:02.658Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}