Loading story…
TP-Link disclosed and patched multiple vulnerabilities in Omada gateways, including critical operating system command injection flaws tracked as CVE-2025-6542 and CVE-2025-7850. According to vendor and CSIRT reporting, successful exploitation could let attackers execute commands on affected devices and potentially gain full control of the gateway. The advisories also identify CVE-2025-6541 and CVE-2025-7851 as high-severity issues that can enable command injection or unauthorized root shell access.
The vendor published patched firmware for multiple affected Omada gateway models, and defenders were urged to update immediately. CSIRT guidance also recommends reviewing device configurations after patching to identify any signs of compromise or unauthorized changes, given the risk that attackers could have obtained privileged access through the exposed management functionality.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
TP-Link published a support statement addressing OS command injection vulnerabilities in Omada gateways, specifically CVE-2025-6541 and CVE-2025-6542.
TP-Link released security updates for Omada gateways to remediate four vulnerabilities, including critical flaws CVE-2025-6542 and CVE-2025-7850 and high-severity issues CVE-2025-6541 and CVE-2025-7851. The advisory identified affected gateway models and corresponding patched firmware versions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TP-Link has released security updates to address four critical vulnerabilities affecting its Omada gateway devices, with two of these flaws enabling remote code execution. The most severe of these vulnerabilities, CVE-2025-6542, carries a CVSS score of 9.3 and allows remote unauthenticated attackers to execute arbitrary commands on the device's underlying operating system. Another critical flaw, CVE-2025-6541, is an operating system command injection vulnerability that can be exploited by attackers with access to the web management interface. CVE-2025-7850, also with a CVSS score of 9.3, requires possession of an administrator password to exploit, but similarly allows arbitrary command execution. The fourth vulnerability, CVE-2025-7851, involves improper privilege management and could enable attackers to obtain a root shell under certain conditions. Affected models include ER8411, ER7412-M2, ER707-M2, ER7206, ER605, ER706W, ER706W-4G, ER7212PC, G36, G611, FR365, FR205, and FR307-M2, with specific firmware versions listed as vulnerable. TP-Link has advised all users of impacted devices to immediately update to the latest firmware versions to mitigate these risks. The company also recommends verifying device configurations after upgrading the firmware to ensure security settings remain intact. There is currently no evidence that these vulnerabilities have been exploited in the wild, but the critical nature of the flaws and the potential for remote, unauthenticated exploitation make prompt patching essential. The vulnerabilities could allow attackers to gain full control over affected devices, potentially enabling lateral movement within networks or use of the devices as a foothold for further attacks. The flaws were disclosed in a coordinated manner, and TP-Link responded by releasing patches and advisories to inform customers. Security researchers have highlighted the risk posed by these vulnerabilities, especially in environments where Omada gateways are used to manage network traffic and security. Organizations using these devices should prioritize patching and review their network segmentation to limit potential exposure. The vulnerabilities underscore the importance of regular firmware updates and strong administrative credential management for network infrastructure devices. TP-Link's advisory provides detailed instructions for identifying affected models and applying the necessary updates. The disclosure has prompted renewed attention to the security of network gateways and the need for ongoing vigilance in monitoring for new vulnerabilities. Security teams are urged to monitor for signs of compromise and to ensure that all network devices are included in vulnerability management programs. The incident serves as a reminder of the critical role that timely patching plays in defending against remote exploitation threats.
Jul 12, 2026
Forescout disclosed 15 vulnerabilities in TP-Link’s Omada zero-touch provisioning ecosystem that can be chained to compromise managed device fleets, hijack controllers and devices, and potentially take over entire networks. The flaws span hardcoded cryptographic material, insecure credential transmission, weak certificate validation, a cloud adoption race condition, cross-site scripting, predictable serial numbers, and default credentials; 11 received CVE identifiers. Researchers said the chain can be combined with previously disclosed remote code execution bugs `CVE-2025-7850` and `CVE-2025-7851` to achieve administrative control and possible root-level command execution on Omada devices, while identifying roughly 1,800 internet-exposed Omada controllers. One of the disclosed issues, `CVE-2025-15628`, carries a CVSS 4.0 score of 8.2 and involves hardcoded certificates shared across Omada deployments, creating a path for attackers who obtain the certificates to impersonate trusted controllers or devices and intercept communications. TP-Link’s advisory portal shows broad ongoing remediation activity across Omada and other product lines, and the company has issued patches and advisories for some of the newly reported weaknesses; however, some structural fixes are not expected until later in 2026 and certain lower-severity issues will remain unpatched. Researchers also warned that related weaknesses may extend beyond Omada to other TP-Link families including VIGI, Festa, Tapo, and Kasa.
Aug 10, 2026
TP-Link disclosed multiple vulnerabilities in ISP-managed **Aginet** networking products, including mesh systems, routers, PON devices, and xDSL modems, with the most serious flaws enabling privileged control of affected devices. The issues include **authentication bypass** in the web management interface (`CVE-2025-30237`, CVSS 8.7), **privilege escalation** in user management (`CVE-2025-30238`, CVSS 8.6), **hardcoded cryptographic keys** that can expose sensitive configuration data (`CVE-2025-30239`, CVSS 8.5), and **OS command injection** in web interface components (`CVE-2025-30241`, CVSS 8.6). TP-Link said exploitation conditions vary by flaw, with some attacks requiring adjacent network access, valid credentials, or access to device storage, while others can be triggered through crafted unauthenticated requests. TP-Link published fixed firmware versions for many country- and ISP-specific model variants and said remediation for ISP-managed devices will be coordinated through service providers. The vendor advised customers to update firmware through device management interfaces or companion applications, restrict access to web administration services, review privileges for unauthorized changes, and contact their ISP if patches are not yet available. Successful exploitation could allow attackers to execute arbitrary commands, create privileged accounts, alter critical settings, or recover embedded keys and decrypt protected data, potentially leading to full device compromise.
Aug 14, 2026