Loading vulnerability…
Unauthenticated OS Command Injection in TP-Link Omada Gateways
CVE-2025-6542 is an arbitrary operating-system command execution vulnerability in TP-Link Omada gateway devices. The flaw permits execution of arbitrary commands on the gateway's underlying operating system. It may be exploitable remotely without authentication, and may also be exploitable by a user able to log in to the web management interface. Affected products include specified ER, G, and FR-series Omada gateways running firmware earlier than their respective fixed builds.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary command execution on the affected gateway and may give an attacker full control of the device. This can result in full compromise of the affected system and may expose sensitive information or enable further manipulation of the gateway.
If you can’t patch tonight, do this now.
Until updates are applied, restrict access to the gateway web-management interface to trusted internal networks and change default or weak passwords. Limiting exposure of the management interface reduces the opportunity for remote unauthenticated exploitation.
Patch, then assume compromise.
Update affected Omada gateways to the vendor-specified fixed firmware or later: ER8411 1.3.3 Build 20251013 Rel.44647; ER7412-M2 1.1.0 Build 20251015 Rel.63594; ER707-M2 1.3.1 Build 20251009 Rel.67687; ER7206 2.2.2 Build 20250724 Rel.11109; ER605 2.3.1 Build 20251015 Rel.78291; ER706W 1.2.1 Build 20250821 Rel.80909; ER706W-4G 1.2.1 Build 20250821 Rel.82492; ER7212PC 2.1.3 Build 20251016 Rel.82571; G36 1.1.4 Build 20251015 Rel.84206; G611 1.2.2 Build 20251017 Rel.45512; FR365 1.1.10 Build 20250626 Rel.81746; FR205 1.0.3 Build 20251016 Rel.61376; and FR307-M2 1.2.5 Build 20251015 Rel.76743. Review device configurations after applying updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.