Critical Command Injection Flaws Patched in TP-Link Omada Gateways

TP-Link has released security updates to address four critical vulnerabilities affecting its Omada gateway devices, with two of these flaws enabling remote code execution. The most severe of these vulnerabilities, CVE-2025-6542, carries a CVSS score of 9.3 and allows remote unauthenticated attackers to execute arbitrary commands on the device's underlying operating system. Another critical flaw, CVE-2025-6541, is an operating system command injection vulnerability that can be exploited by attackers with access to the web management interface. CVE-2025-7850, also with a CVSS score of 9.3, requires possession of an administrator password to exploit, but similarly allows arbitrary command execution. The fourth vulnerability, CVE-2025-7851, involves improper privilege management and could enable attackers to obtain a root shell under certain conditions. Affected models include ER8411, ER7412-M2, ER707-M2, ER7206, ER605, ER706W, ER706W-4G, ER7212PC, G36, G611, FR365, FR205, and FR307-M2, with specific firmware versions listed as vulnerable. TP-Link has advised all users of impacted devices to immediately update to the latest firmware versions to mitigate these risks. The company also recommends verifying device configurations after upgrading the firmware to ensure security settings remain intact. There is currently no evidence that these vulnerabilities have been exploited in the wild, but the critical nature of the flaws and the potential for remote, unauthenticated exploitation make prompt patching essential. The vulnerabilities could allow attackers to gain full control over affected devices, potentially enabling lateral movement within networks or use of the devices as a foothold for further attacks. The flaws were disclosed in a coordinated manner, and TP-Link responded by releasing patches and advisories to inform customers. Security researchers have highlighted the risk posed by these vulnerabilities, especially in environments where Omada gateways are used to manage network traffic and security. Organizations using these devices should prioritize patching and review their network segmentation to limit potential exposure. The vulnerabilities underscore the importance of regular firmware updates and strong administrative credential management for network infrastructure devices. TP-Link's advisory provides detailed instructions for identifying affected models and applying the necessary updates. The disclosure has prompted renewed attention to the security of network gateways and the need for ongoing vigilance in monitoring for new vulnerabilities. Security teams are urged to monitor for signs of compromise and to ensure that all network devices are included in vulnerability management programs. The incident serves as a reminder of the critical role that timely patching plays in defending against remote exploitation threats.

Oct 23, 2025

TP-Link Omada ZTP flaws enable controller hijacking and full network takeover

Forescout disclosed 15 vulnerabilities in TP-Link’s Omada zero-touch provisioning ecosystem that can be chained to compromise managed device fleets, hijack controllers and devices, and potentially take over entire networks. The flaws span hardcoded cryptographic material, insecure credential transmission, weak certificate validation, a cloud adoption race condition, cross-site scripting, predictable serial numbers, and default credentials; 11 received CVE identifiers. Researchers said the chain can be combined with previously disclosed remote code execution bugs `CVE-2025-7850` and `CVE-2025-7851` to achieve administrative control and possible root-level command execution on Omada devices, while identifying roughly 1,800 internet-exposed Omada controllers. One of the disclosed issues, `CVE-2025-15628`, carries a CVSS 4.0 score of 8.2 and involves hardcoded certificates shared across Omada deployments, creating a path for attackers who obtain the certificates to impersonate trusted controllers or devices and intercept communications. TP-Link’s advisory portal shows broad ongoing remediation activity across Omada and other product lines, and the company has issued patches and advisories for some of the newly reported weaknesses; however, some structural fixes are not expected until later in 2026 and certain lower-severity issues will remain unpatched. Researchers also warned that related weaknesses may extend beyond Omada to other TP-Link families including VIGI, Festa, Tapo, and Kasa.

Aug 6, 2026

Multiple TP-Link Aginet Flaws Enable Auth Bypass, Privilege Escalation, and Command Injection

TP-Link disclosed multiple vulnerabilities in ISP-managed **Aginet** networking products, including mesh systems, routers, PON devices, and xDSL modems, with the most serious flaws enabling privileged control of affected devices. The issues include **authentication bypass** in the web management interface (`CVE-2025-30237`, CVSS 8.7), **privilege escalation** in user management (`CVE-2025-30238`, CVSS 8.6), **hardcoded cryptographic keys** that can expose sensitive configuration data (`CVE-2025-30239`, CVSS 8.5), and **OS command injection** in web interface components (`CVE-2025-30241`, CVSS 8.6). TP-Link said exploitation conditions vary by flaw, with some attacks requiring adjacent network access, valid credentials, or access to device storage, while others can be triggered through crafted unauthenticated requests. TP-Link published fixed firmware versions for many country- and ISP-specific model variants and said remediation for ISP-managed devices will be coordinated through service providers. The vendor advised customers to update firmware through device management interfaces or companion applications, restrict access to web administration services, review privileges for unauthorized changes, and contact their ISP if patches are not yet available. Successful exploitation could allow attackers to execute arbitrary commands, create privileged accounts, alter critical settings, or recover embedded keys and decrypt protected data, potentially leading to full device compromise.

Aug 11, 2026

Critical Command Injection Flaws Patched in TP-Link Omada Gateways

How this story unfolded

TP-Link publishes Omada gateway vulnerability statement

TP-Link releases security updates for four Omada gateway flaws

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Critical Command Injection Flaws Patched in TP-Link Omada Gateways

How this story unfolded

TP-Link publishes Omada gateway vulnerability statement

TP-Link releases security updates for four Omada gateway flaws

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Critical Command Injection Flaws Patched in TP-Link Omada Gateways

How this story unfolded

TP-Link publishes Omada gateway vulnerability statement

TP-Link releases security updates for four Omada gateway flaws

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

TP-Link Omada Gateway Vulnerabilities Allow Remote Code Execution

TP-Link Omada ZTP flaws enable controller hijacking and full network takeover

Multiple TP-Link Aginet Flaws Enable Auth Bypass, Privilege Escalation, and Command Injection

Critical Command Injection Flaws Patched in TP-Link Omada Gateways

How this story unfolded

TP-Link publishes Omada gateway vulnerability statement

TP-Link releases security updates for four Omada gateway flaws

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

TP-Link Omada Gateway Vulnerabilities Allow Remote Code Execution

TP-Link Omada ZTP flaws enable controller hijacking and full network takeover

Multiple TP-Link Aginet Flaws Enable Auth Bypass, Privilege Escalation, and Command Injection