Loading vulnerability…
Command Injection in TP-Link Omada Gateways Web Portal
CVE-2025-7850 is a command injection vulnerability in TP-Link Omada gateways. The flaw is reachable through the gateways’ web management portal after administrator authentication and allows attacker-controlled input to be interpreted as operating system commands on the underlying device. Available reporting describes the issue as exploitable in the authenticated administrative web interface and capable of leading to full system compromise. In demonstrated attack chains, this vulnerability has also been combined with other Omada provisioning and controller weaknesses to transition from controller or credential compromise to root-level command execution on managed gateways.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in arbitrary command execution on the affected gateway with root-level privileges, enabling full takeover of the device. Consequences can include modification of network configuration, persistence, interception or redirection of traffic, disclosure of sensitive information present on the device, and use of the gateway as a pivot point for further compromise of the internal network. Reporting also indicates the flaw can serve as the final stage of broader Omada attack chains.
If you can’t patch tonight, do this now.
Until patches are fully deployed, restrict access to the Omada management interface to trusted internal administration networks only, disable any unnecessary external exposure of the web portal, enforce strong unique administrator credentials, and enable multi-factor authentication where supported for associated management accounts. Monitor administrative activity and gateway configuration changes for signs of abuse, and segment management access to reduce the chance that stolen controller or administrator credentials can be used to reach vulnerable gateways.
Patch, then assume compromise.
Apply the vendor firmware updates for affected Omada gateway models. Reported fixed versions are: ER8411 1.3.3 Build 20251013 Rel.44647 or later; ER7412-M2 1.1.0 Build 20251015 Rel.63594 or later; ER707-M2 1.3.1 Build 20251009 Rel.67687 or later; ER7206 2.2.2 Build 20250724 Rel.11109 or later; ER605 2.3.1 Build 20251015 Rel.78291 or later; ER706W 1.2.1 Build 20250821 Rel.80909 or later; ER706W-4G 1.2.1 Build 20250821 Rel.82492 or later; ER7212PC 2.1.3 Build 20251016 Rel.82571 or later; G36 1.1.4 Build 20251015 Rel.84206 or later; G611 1.2.2 Build 20251017 Rel.45512 or later; FR365 1.1.10 Build 20250626 Rel.81746 or later; FR205 1.0.3 Build 20251016 Rel.61376 or later; FR307-M2 1.2.5 Build 20251015 Rel.76743 or later. After patching, review device configuration for unauthorized changes and rotate credentials if compromise is suspected.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.