Loading vulnerability…
OS Command Injection in TP-Link Omada Gateways Web Management Interface
CVE-2025-6541 is a high-severity OS command injection vulnerability affecting multiple TP-Link Omada gateway devices. The flaw allows arbitrary operating system commands to be executed through the product’s web management interface. Available reporting indicates the vulnerable condition can be reached by a user able to log in to the web administrative interface, and some reporting further states it may also be exploitable by a remote unauthenticated attacker. The issue affects numerous Omada gateway models across the ER, G, and FR series prior to vendor-fixed firmware releases.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows execution of arbitrary commands on the underlying operating system of the affected gateway. This can enable full compromise of the device, including unauthorized administrative control, access to sensitive information handled by the gateway, modification of configuration, and use of the device as a pivot point for further activity on the network.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict access to the web management interface to trusted internal networks only, disable any unnecessary remote management exposure, and ensure strong non-default credentials are used for all administrative accounts. Closely monitor gateway administration activity and configuration changes until updates can be applied.
Patch, then assume compromise.
Upgrade affected TP-Link Omada gateways to the vendor-provided fixed firmware versions. Reported fixed versions include: ER8411 1.3.3 Build 20251013 Rel.44647 or later; ER7412-M2 1.1.0 Build 20251015 Rel.63594 or later; ER707-M2 1.3.1 Build 20251009 Rel.67687 or later; ER7206 2.2.2 Build 20250724 Rel.11109 or later; ER605 2.3.1 Build 20251015 Rel.78291 or later; ER706W 1.2.1 Build 20250821 Rel.80909 or later; ER706W-4G 1.2.1 Build 20250821 Rel.82492 or later; ER7212PC 2.1.3 Build 20251016 Rel.82571 or later; G36 1.1.4 Build 20251015 Rel.84206 or later; G611 1.2.2 Build 20251017 Rel.45512 or later; FR365 1.1.10 Build 20250626 Rel.81746 or later; FR205 1.0.3 Build 20251016 Rel.61376 or later; FR307-M2 1.2.5 Build 20251015 Rel.76743 or later. After patching, review device configurations for unauthorized changes.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.