Loading vulnerability…
Root shell access vulnerability in TP-Link Omada gateways
CVE-2025-7851 is a high-severity vulnerability in TP-Link Omada gateways that may allow an attacker to obtain a root shell on the underlying operating system under restricted conditions. Available reporting characterizes it as a root access vulnerability affecting multiple Omada gateway models and notes that it has been used in demonstrated attack chains together with other Omada weaknesses to achieve root-level command execution on managed devices. Publicly available information does not provide sufficient technical detail to identify the exact vulnerable function, code path, or root cause, so a more specific vulnerability description is currently not available.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can provide unauthorized access to a root-privileged shell on the affected gateway’s underlying operating system. This can enable full device compromise, execution of arbitrary commands with elevated privileges, access to sensitive configuration and credential material present on the device, modification of network and security settings, and use of the gateway as a pivot point for further intrusion into the managed environment. In chained attack scenarios, the vulnerability can contribute to remote root-level command execution across managed Omada devices.
If you can’t patch tonight, do this now.
Until patches are fully deployed, restrict access to gateway management interfaces to trusted internal networks only, avoid exposing administrative interfaces to the internet, enforce strong unique administrator passwords, change any default or weak credentials, enable multi-factor authentication where supported, and monitor for suspicious administrative activity or unexpected configuration changes. Network segmentation and limiting administrative reachability can reduce exposure.
Patch, then assume compromise.
Apply TP-Link firmware updates for affected Omada gateway models to the vendor-fixed versions or later. Public reporting indicates fixes were released for affected ER, G, and FR series gateways. After patching, review device configurations for unauthorized changes and rotate credentials or other secrets that may have been exposed if compromise is suspected.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.