Search
Find a vulnerability
Search criteria
8 vulnerabilities found for dr3650v_firmware by tp-link
CVE-2026-9033 (GCVE-0-2026-9033)
Vulnerability from nvd – Published: 2026-08-20 18:31 – Updated: 2026-08-20 18:59
VLAI
EPSS
VEX
Title
Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways
Summary
An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.
Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 18:59 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.omadanetworks.com/en/support/download/ | patch |
| https://www.omadanetworks.com/us/support/download/ | patch |
| https://www.tp-link.com/us/support/faq/5256/ | vendor-advisory |
Impacted products
19 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | ER7212PC v2 |
Affected:
0 , < 2.4.3 Build 20260722 Rel.40250
(custom)
|
|
| TP-Link Systems Inc. | ER605 v2 |
Affected:
0 , < 2.4.4 Build 20260630 Rel.14398
(custom)
|
|
| TP-Link Systems Inc. | ER7206 v2 |
Affected:
0 , < 2.3.5 Build 20260625 Rel.43136
(custom)
|
|
| TP-Link Systems Inc | ER7406 v1 |
Affected:
0 , < 1.3.4 Build 20260625 Rel.43136
(custom)
|
|
| TP-Link Systems Inc. | ER707-M2 v1 |
Affected:
0 , < 1.4.4 Build 20260625 Rel.43063
(custom)
|
|
| TP-Link Systems Inc | ER7412-M2 v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.82947
(custom)
|
|
| TP-Link Systems Inc. | ER8411 v1 |
Affected:
0 , < 1.4.1 Build 20260708 Rel.64832
(custom)
|
|
| TP-Link Systems Inc. | ER706W v1 |
Affected:
0 , < 1.2.11 Build 20260723 Rel.41567
(custom)
|
|
| TP-Link Systems Inc. | ER706W-4G v1 |
Affected:
0 , < 1.2.6 Build 20260723 Rel.41321
(custom)
|
|
| TP-Link Systems Inc. | ER706W-4G v2 |
Affected:
0 , < 2.1.11 Build 20260723 Rel.41624
(custom)
|
|
| TP-Link Systems Inc. | ER706WP-4G v1 |
Affected:
0 , < 1.1.11 Build 20260723 Rel.41624
(custom)
|
|
| TP-Link Systems Inc. | ER703WP-4G-Outdoor v1 |
Affected:
0 , < 1.1.7 Build 20260723 Rel.41712
(custom)
|
|
| TP-Link Systems Inc. | DR3220v-4G v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.82652
(custom)
|
|
| TP-Link Systems Inc. | DR3650v v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.83311
(custom)
|
|
| TP-Link Systems Inc. | DR3650v-4G v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.83347
(custom)
|
|
| TP-Link Systems Inc. | ER603WP-4G-Outdoor v1 |
Affected:
0 , < 1.0.2 Build 20260723 Rel.43271
(custom)
|
|
| TP-Link Systems Inc. | DR3150 v1 |
Affected:
0 , < 1.0.1 Build 20260722 Rel.16854
(custom)
|
|
| TP-Link Systems Inc. | ER701-5G-Outdoor v1 |
Affected:
0 , < 1.0.3 Build 20260723 Rel.40931
(custom)
|
|
| TP-Link Systems Inc. | ER605W v2 |
Affected:
0 , < 2.0.4 Build 20260723 Rel.43763
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9033",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T18:59:29.032581Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:59:36.657Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ER7212PC v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.4.3 Build 20260722 Rel.40250",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER605 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.4.4 Build 20260630 Rel.14398",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7206 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.3.5 Build 20260625 Rel.43136",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7406 v1",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"lessThan": "1.3.4 Build 20260625 Rel.43136",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER707-M2 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.4 Build 20260625 Rel.43063",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7412-M2 v1",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.82947",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER8411 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.1 Build 20260708 Rel.64832",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706W v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.11 Build 20260723 Rel.41567",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706W-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.6 Build 20260723 Rel.41321",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706W-4G v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.1.11 Build 20260723 Rel.41624",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706WP-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.11 Build 20260723 Rel.41624",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER703WP-4G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.7 Build 20260723 Rel.41712",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3220v-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.82652",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3650v v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.83311",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3650v-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.83347",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER603WP-4G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.2 Build 20260723 Rel.43271",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3150 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.1 Build 20260722 Rel.16854",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER701-5G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.3 Build 20260723 Rel.40931",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER605W v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.0.4 Build 20260723 Rel.43763",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yoontae Lee (@yunttai)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.\u0026nbsp;\u003c/p\u003e\u003cp\u003eSuccessful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.\u003c/p\u003e"
}
],
"value": "An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.\u00a0\n\n\n\nSuccessful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:31:54.806Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"name": "Omada Gateway Firmware Downloads (EN)",
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/en/support/download/"
},
{
"name": "Omada Gateway Firmware Downloads (US)",
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/us/support/download/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5256/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-9033",
"datePublished": "2026-08-20T18:31:54.806Z",
"dateReserved": "2026-05-19T16:30:37.346Z",
"dateUpdated": "2026-08-20T18:59:36.657Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19683 (GCVE-0-2026-19683)
Vulnerability from nvd – Published: 2026-08-20 18:32 – Updated: 2026-08-20 18:58
VLAI
EPSS
VEX
Title
Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways
Summary
A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path.
Successful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 18:55 UTC
CWE
- CWE-319 - Cleartext transmission of sensitive information
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.omadanetworks.com/en/support/download/ | patch |
| https://www.omadanetworks.com/us/support/download/ | patch |
| https://www.tp-link.com/us/support/faq/5256/ | vendor-advisory |
Impacted products
19 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | ER7212PC v2 |
Affected:
0 , < 2.4.3 Build 20260722 Rel.40250
(custom)
|
|
| TP-Link Systems Inc. | ER605 v2 |
Affected:
0 , < 2.4.4 Build 20260630 Rel.14398
(custom)
|
|
| TP-Link Systems Inc. | ER7206 v2 |
Affected:
0 , < 2.3.5 Build 20260625 Rel.43136
(custom)
|
|
| TP-Link Systems Inc | ER7406 v1 |
Affected:
0 , < 1.3.4 Build 20260625 Rel.43136
(custom)
|
|
| TP-Link Systems Inc. | ER707-M2 v1 |
Affected:
0 , < 1.4.4 Build 20260625 Rel.43063
(custom)
|
|
| TP-Link Systems Inc | ER7412-M2 v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.82947
(custom)
|
|
| TP-Link Systems Inc. | ER8411 v1 |
Affected:
0 , < 1.4.1 Build 20260708 Rel.64832
(custom)
|
|
| TP-Link Systems Inc. | ER706W v1 |
Affected:
0 , < 1.2.11 Build 20260723 Rel.41567
(custom)
|
|
| TP-Link Systems Inc. | v1 |
Affected:
0 , < 1.2.6 Build 20260723 Rel.41321
(custom)
|
|
| TP-Link Systems Inc. | ER706W-4G v2 |
Affected:
0 , < 2.1.11 Build 20260723 Rel.41624
(custom)
|
|
| TP-Link Systems Inc. | ER706WP-4G v1 |
Affected:
0 , < 1.1.11 Build 20260723 Rel.41624
(custom)
|
|
| TP-Link Systems Inc. | ER703WP-4G-Outdoor v1 |
Affected:
0 , < 1.1.7 Build 20260723 Rel.41712
(custom)
|
|
| TP-Link Systems Inc. | DR3220v-4G v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.82652
(custom)
|
|
| TP-Link Systems Inc. | DR3650v v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.83311
(custom)
|
|
| TP-Link Systems Inc. | DR3650v-4G v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.83347
(custom)
|
|
| TP-Link Systems Inc. | ER603WP-4G-Outdoor v1 |
Affected:
0 , < 1.0.2 Build 20260723 Rel.43271
(custom)
|
|
| TP-Link Systems Inc. | DR3150 v1 |
Affected:
0 , < 1.0.1 Build 20260722 Rel.16854
(custom)
|
|
| TP-Link Systems Inc. | ER701-5G-Outdoor v1 |
Affected:
0 , < 1.0.3 Build 20260723 Rel.40931
(custom)
|
|
| TP-Link Systems Inc. | ER605W v2 |
Affected:
0 , < 2.0.4 Build 20260723 Rel.43763
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19683",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T18:55:44.295305Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:58:42.948Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ER7212PC v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.4.3 Build 20260722 Rel.40250",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER605 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.4.4 Build 20260630 Rel.14398",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7206 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.3.5 Build 20260625 Rel.43136",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7406 v1",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"lessThan": "1.3.4 Build 20260625 Rel.43136",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER707-M2 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.4 Build 20260625 Rel.43063",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7412-M2 v1",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.82947",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER8411 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.1 Build 20260708 Rel.64832",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706W v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.11 Build 20260723 Rel.41567",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.6 Build 20260723 Rel.41321",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706W-4G v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.1.11 Build 20260723 Rel.41624",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706WP-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.11 Build 20260723 Rel.41624",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER703WP-4G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.7 Build 20260723 Rel.41712",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3220v-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.82652",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3650v v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.83311",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3650v-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.83347",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER603WP-4G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.2 Build 20260723 Rel.43271",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3150 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.1 Build 20260722 Rel.16854",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER701-5G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.3 Build 20260723 Rel.40931",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER605W v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.0.4 Build 20260723 Rel.43763",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cp\u003eA vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can\u0026nbsp;observe\u0026nbsp;or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path.\u0026nbsp;\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eSuccessful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment.\u003c/p\u003e\u003c/div\u003e"
}
],
"value": "A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can\u00a0observe\u00a0or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path.\u00a0\n\n\n\n\n\nSuccessful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment."
}
],
"impacts": [
{
"capecId": "CAPEC-158",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-158 Sniffing Network Traffic"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "CWE-319 Cleartext transmission of sensitive information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:32:27.650Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"name": "Omada Gateway Firmware Downloads (EN)",
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/en/support/download/"
},
{
"name": "Omada Gateway Firmware Downloads (US)",
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/us/support/download/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5256/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-19683",
"datePublished": "2026-08-20T18:32:27.650Z",
"dateReserved": "2026-08-12T23:34:21.158Z",
"dateUpdated": "2026-08-20T18:58:42.948Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19586 (GCVE-0-2026-19586)
Vulnerability from nvd – Published: 2026-08-20 18:32 – Updated: 2026-08-28 16:10
VLAI
EPSS
VEX
Title
Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways
Summary
A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.
Successful exploitation may allow arbitrary command execution, potentially
leading to full compromise of the affected device.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.omadanetworks.com/en/support/download/ | patch |
| https://www.omadanetworks.com/us/support/download/ | patch |
| https://www.tp-link.com/us/support/faq/5256/ | vendor-advisory |
| https://mattg.systems/posts/cve-2026-19586/ | third-party-advisory |
Impacted products
19 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | ER7212PC v2 |
Affected:
0 , < 2.4.3 Build 20260722 Rel.40250
(custom)
|
|
| TP-Link Systems Inc. | ER605 v2 |
Affected:
0 , < 2.4.4 Build 20260630 Rel.14398
(custom)
|
|
| TP-Link Systems Inc. | ER7206 v2 |
Affected:
0 , < 2.3.5 Build 20260625 Rel.43136
(custom)
|
|
| TP-Link Systems Inc | ER7406 v1 |
Affected:
0 , < 1.3.4 Build 20260625 Rel.43136
(custom)
|
|
| TP-Link Systems Inc. | ER707-M2 v1 |
Affected:
0 , < 1.4.4 Build 20260625 Rel.43063
(custom)
|
|
| TP-Link Systems Inc | ER7412-M2 v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.82947
(custom)
|
|
| TP-Link Systems Inc. | ER8411 v1 |
Affected:
0 , < 1.4.1 Build 20260708 Rel.64832
(custom)
|
|
| TP-Link Systems Inc. | ER706W v1 |
Affected:
0 , < 1.2.11 Build 20260723 Rel.41567
(custom)
|
|
| TP-Link Systems Inc. | v1 |
Affected:
0 , < 1.2.6 Build 20260723 Rel.41321
(custom)
|
|
| TP-Link Systems Inc. | ER706W-4G v2 |
Affected:
0 , < 2.1.11 Build 20260723 Rel.41624
(custom)
|
|
| TP-Link Systems Inc. | ER706WP-4G v1 |
Affected:
0 , < 1.1.11 Build 20260723 Rel.41624
(custom)
|
|
| TP-Link Systems Inc. | ER703WP-4G-Outdoor v1 |
Affected:
0 , < 1.1.7 Build 20260723 Rel.41712
(custom)
|
|
| TP-Link Systems Inc. | DR3220v-4G v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.82652
(custom)
|
|
| TP-Link Systems Inc. | DR3650v v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.83311
(custom)
|
|
| TP-Link Systems Inc. | DR3650v-4G v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.83347
(custom)
|
|
| TP-Link Systems Inc. | ER603WP-4G-Outdoor v1 |
Affected:
0 , < 1.0.2 Build 20260723 Rel.43271
(custom)
|
|
| TP-Link Systems Inc. | DR3150 v1 |
Affected:
0 , < 1.0.1 Build 20260722 Rel.16854
(custom)
|
|
| TP-Link Systems Inc. | ER701-5G-Outdoor v1 |
Affected:
0 , < 1.0.3 Build 20260723 Rel.40931
(custom)
|
|
| TP-Link Systems Inc. | ER605W v2 |
Affected:
0 , < 2.0.4 Build 20260723 Rel.43763
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19586",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T03:56:42.164Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ER7212PC v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.4.3 Build 20260722 Rel.40250",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER605 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.4.4 Build 20260630 Rel.14398",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7206 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.3.5 Build 20260625 Rel.43136",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7406 v1",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"lessThan": "1.3.4 Build 20260625 Rel.43136",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER707-M2 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.4 Build 20260625 Rel.43063",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7412-M2 v1",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.82947",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER8411 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.1 Build 20260708 Rel.64832",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706W v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.11 Build 20260723 Rel.41567",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.6 Build 20260723 Rel.41321",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706W-4G v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.1.11 Build 20260723 Rel.41624",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706WP-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.11 Build 20260723 Rel.41624",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER703WP-4G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.7 Build 20260723 Rel.41712",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3220v-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.82652",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3650v v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.83311",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3650v-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.83347",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER603WP-4G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.2 Build 20260723 Rel.43271",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3150 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.1 Build 20260722 Rel.16854",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER701-5G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.3 Build 20260723 Rel.40931",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER605W v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.0.4 Build 20260723 Rel.43763",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matt Graham (mattg.systems)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.\u0026nbsp;\u003c/p\u003e\u003cp\u003eSuccessful exploitation may allow arbitrary command execution,\u0026nbsp;\u003cspan\u003epotentially\nleading to full compromise of the affected device.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.\u00a0\n\n\n\nSuccessful exploitation may allow arbitrary command execution,\u00a0potentially\nleading to full compromise of the affected device."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T16:10:43.693Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"name": "Omada Gateway Firmware Downloads (EN)",
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/en/support/download/"
},
{
"name": "Omada Gateway Firmware Downloads (US)",
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/us/support/download/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5256/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://mattg.systems/posts/cve-2026-19586/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-19586",
"datePublished": "2026-08-20T18:32:06.942Z",
"dateReserved": "2026-08-12T00:06:23.069Z",
"dateUpdated": "2026-08-28T16:10:43.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-9290 (GCVE-0-2025-9290)
Vulnerability from nvd – Published: 2026-01-22 23:14 – Updated: 2026-01-23 20:04
VLAI
EPSS
VEX
Title
Authentication Weakness on Omada Controllers, Gateways and Access Points
Summary
An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-23 20:04 UTC
CWE
- CWE-760 - Use of a One-Way Hash with a Predictable Salt
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://support.omadanetworks.com/us/download/ | patch |
| https://support.omadanetworks.com/en/download/ | patch |
| https://support.omadanetworks.com/us/document/114950/ | vendor-advisory |
Impacted products
30 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9290",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-23T20:04:16.930287Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-23T20:04:29.976Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"Linux"
],
"product": "Omada Software Controller",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "6.0.0.24",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Cloud Controller",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "6.0.0.100",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Hardware Controller (OC200, OC300, OC400)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "6.0.0.34",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Hardware Controller OC220",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "5.15.24",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway (ER605 v2.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.3.2 Build 20251029 Rel.12727",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway (ER7206 v2.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.2.2 Build 20250724 Rel.11109",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway (ER7406, ER706W, ER706-4G)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.x",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway (ER707-M2, ER-8411)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.3.x",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway (ER7412-M2, ER706WP-4G, ER703WP-4G-Outdoor, DR3220v-4G, DR3650v, DR3650v-4G)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway (ER8411)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.3.5 Build 20251028 Rel.06811",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway (ER706W-4G 2.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.1.0 Build 20250810 Rel.77020",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway (ER701-5G-Outdoor)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.0 Build 20250826 Rel.68862",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway (ER605W 2.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.0.2 Build 20250723 Rel.39048",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway ER7212PC 2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.2.1 Build 20251027 Rel.75129",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Festa Gateway FR365",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.10 Build 20250626 Rel.81746",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway G36W-4G",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.5 Build 20250710 Rel.62142",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP660 HD v1.0/v2.0, EAP620 HD v2.0/v3.0/v3.20, EAP610/EAP610-Outdoor v1.0/v2.0, EAP623-Outdoor HD v1.0, EAP625-Outdoor HD v1.0)EAP",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.6.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP655-Wall v1.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.6.2 Build 20251107 Rel.35700",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP772 v1.0, EAP773 v1.0, EAP783 v1.0, EAP787 v1.0, EAP720 v1.0, EAP725-Wall v1.0, EAp723 v2.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP723 v1.0, EAP772 v2.0, EAP772-Outdoor v 1.0, EAP770 v2.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.3.2 Build 20250901 Rel.52255",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP215 Bridge KIT 3.0, EAP211 Bridge KIT 3.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.4 Build 20251112 Rel.34769",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Beam Bridge 5 UR v1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.5 Build 20250928 Rel.68499",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP603GP-Desktop, EAP615GP-Wall 1.0/1.20, EAP625GP-Wall 1.0/1.20, EAP610GP-Desktop 1.0/1.20/1.26), EAP650-Desktop v1.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP650GP-Desktop 1.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.1 Build 20250819 Rel.60298",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP653 v1.0, EAP650-Outdoor v1.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.3.3 Build 20251111 Rel.72627",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP230-Wall v1.0, EAP235-Wall v1.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "3.3.1 Build 20251203 Rel.58135",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP603-Outdoor v1.0, EAP615-Wall v1.0/v1.20)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.5.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP653 UR v1.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.2 Build 20251208 Rel.43830",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP615-Wall v1.0/v1.20)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.5.10 Build 20250903 Rel.49784",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada EAP100-Bridge KIT v1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.3 Build 20251015 Rel.62058",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Stanislav Dashevskyi and Francesco La Spina of Forescout Technologies"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality."
}
],
"value": "An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality."
}
],
"impacts": [
{
"capecId": "CAPEC-112",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-112 Brute Force"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-760",
"description": "CWE-760 Use of a One-Way Hash with a Predictable Salt",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-22T23:14:45.823Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://support.omadanetworks.com/us/download/"
},
{
"tags": [
"patch"
],
"url": "https://support.omadanetworks.com/en/download/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://support.omadanetworks.com/us/document/114950/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authentication Weakness on Omada Controllers, Gateways and Access Points",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2025-9290",
"datePublished": "2026-01-22T23:14:45.823Z",
"dateReserved": "2025-08-20T22:24:20.340Z",
"dateUpdated": "2026-01-23T20:04:29.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19683 (GCVE-0-2026-19683)
Vulnerability from cvelistv5 – Published: 2026-08-20 18:32 – Updated: 2026-08-20 18:58
VLAI
EPSS
VEX
Title
Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways
Summary
A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path.
Successful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 18:55 UTC
CWE
- CWE-319 - Cleartext transmission of sensitive information
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.omadanetworks.com/en/support/download/ | patch |
| https://www.omadanetworks.com/us/support/download/ | patch |
| https://www.tp-link.com/us/support/faq/5256/ | vendor-advisory |
Impacted products
19 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | ER7212PC v2 |
Affected:
0 , < 2.4.3 Build 20260722 Rel.40250
(custom)
|
|
| TP-Link Systems Inc. | ER605 v2 |
Affected:
0 , < 2.4.4 Build 20260630 Rel.14398
(custom)
|
|
| TP-Link Systems Inc. | ER7206 v2 |
Affected:
0 , < 2.3.5 Build 20260625 Rel.43136
(custom)
|
|
| TP-Link Systems Inc | ER7406 v1 |
Affected:
0 , < 1.3.4 Build 20260625 Rel.43136
(custom)
|
|
| TP-Link Systems Inc. | ER707-M2 v1 |
Affected:
0 , < 1.4.4 Build 20260625 Rel.43063
(custom)
|
|
| TP-Link Systems Inc | ER7412-M2 v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.82947
(custom)
|
|
| TP-Link Systems Inc. | ER8411 v1 |
Affected:
0 , < 1.4.1 Build 20260708 Rel.64832
(custom)
|
|
| TP-Link Systems Inc. | ER706W v1 |
Affected:
0 , < 1.2.11 Build 20260723 Rel.41567
(custom)
|
|
| TP-Link Systems Inc. | v1 |
Affected:
0 , < 1.2.6 Build 20260723 Rel.41321
(custom)
|
|
| TP-Link Systems Inc. | ER706W-4G v2 |
Affected:
0 , < 2.1.11 Build 20260723 Rel.41624
(custom)
|
|
| TP-Link Systems Inc. | ER706WP-4G v1 |
Affected:
0 , < 1.1.11 Build 20260723 Rel.41624
(custom)
|
|
| TP-Link Systems Inc. | ER703WP-4G-Outdoor v1 |
Affected:
0 , < 1.1.7 Build 20260723 Rel.41712
(custom)
|
|
| TP-Link Systems Inc. | DR3220v-4G v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.82652
(custom)
|
|
| TP-Link Systems Inc. | DR3650v v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.83311
(custom)
|
|
| TP-Link Systems Inc. | DR3650v-4G v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.83347
(custom)
|
|
| TP-Link Systems Inc. | ER603WP-4G-Outdoor v1 |
Affected:
0 , < 1.0.2 Build 20260723 Rel.43271
(custom)
|
|
| TP-Link Systems Inc. | DR3150 v1 |
Affected:
0 , < 1.0.1 Build 20260722 Rel.16854
(custom)
|
|
| TP-Link Systems Inc. | ER701-5G-Outdoor v1 |
Affected:
0 , < 1.0.3 Build 20260723 Rel.40931
(custom)
|
|
| TP-Link Systems Inc. | ER605W v2 |
Affected:
0 , < 2.0.4 Build 20260723 Rel.43763
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19683",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T18:55:44.295305Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:58:42.948Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ER7212PC v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.4.3 Build 20260722 Rel.40250",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER605 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.4.4 Build 20260630 Rel.14398",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7206 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.3.5 Build 20260625 Rel.43136",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7406 v1",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"lessThan": "1.3.4 Build 20260625 Rel.43136",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER707-M2 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.4 Build 20260625 Rel.43063",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7412-M2 v1",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.82947",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER8411 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.1 Build 20260708 Rel.64832",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706W v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.11 Build 20260723 Rel.41567",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.6 Build 20260723 Rel.41321",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706W-4G v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.1.11 Build 20260723 Rel.41624",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706WP-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.11 Build 20260723 Rel.41624",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER703WP-4G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.7 Build 20260723 Rel.41712",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3220v-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.82652",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3650v v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.83311",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3650v-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.83347",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER603WP-4G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.2 Build 20260723 Rel.43271",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3150 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.1 Build 20260722 Rel.16854",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER701-5G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.3 Build 20260723 Rel.40931",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER605W v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.0.4 Build 20260723 Rel.43763",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cp\u003eA vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can\u0026nbsp;observe\u0026nbsp;or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path.\u0026nbsp;\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eSuccessful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment.\u003c/p\u003e\u003c/div\u003e"
}
],
"value": "A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can\u00a0observe\u00a0or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path.\u00a0\n\n\n\n\n\nSuccessful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment."
}
],
"impacts": [
{
"capecId": "CAPEC-158",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-158 Sniffing Network Traffic"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "CWE-319 Cleartext transmission of sensitive information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:32:27.650Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"name": "Omada Gateway Firmware Downloads (EN)",
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/en/support/download/"
},
{
"name": "Omada Gateway Firmware Downloads (US)",
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/us/support/download/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5256/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-19683",
"datePublished": "2026-08-20T18:32:27.650Z",
"dateReserved": "2026-08-12T23:34:21.158Z",
"dateUpdated": "2026-08-20T18:58:42.948Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19586 (GCVE-0-2026-19586)
Vulnerability from cvelistv5 – Published: 2026-08-20 18:32 – Updated: 2026-08-28 16:10
VLAI
EPSS
VEX
Title
Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways
Summary
A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.
Successful exploitation may allow arbitrary command execution, potentially
leading to full compromise of the affected device.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.omadanetworks.com/en/support/download/ | patch |
| https://www.omadanetworks.com/us/support/download/ | patch |
| https://www.tp-link.com/us/support/faq/5256/ | vendor-advisory |
| https://mattg.systems/posts/cve-2026-19586/ | third-party-advisory |
Impacted products
19 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | ER7212PC v2 |
Affected:
0 , < 2.4.3 Build 20260722 Rel.40250
(custom)
|
|
| TP-Link Systems Inc. | ER605 v2 |
Affected:
0 , < 2.4.4 Build 20260630 Rel.14398
(custom)
|
|
| TP-Link Systems Inc. | ER7206 v2 |
Affected:
0 , < 2.3.5 Build 20260625 Rel.43136
(custom)
|
|
| TP-Link Systems Inc | ER7406 v1 |
Affected:
0 , < 1.3.4 Build 20260625 Rel.43136
(custom)
|
|
| TP-Link Systems Inc. | ER707-M2 v1 |
Affected:
0 , < 1.4.4 Build 20260625 Rel.43063
(custom)
|
|
| TP-Link Systems Inc | ER7412-M2 v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.82947
(custom)
|
|
| TP-Link Systems Inc. | ER8411 v1 |
Affected:
0 , < 1.4.1 Build 20260708 Rel.64832
(custom)
|
|
| TP-Link Systems Inc. | ER706W v1 |
Affected:
0 , < 1.2.11 Build 20260723 Rel.41567
(custom)
|
|
| TP-Link Systems Inc. | v1 |
Affected:
0 , < 1.2.6 Build 20260723 Rel.41321
(custom)
|
|
| TP-Link Systems Inc. | ER706W-4G v2 |
Affected:
0 , < 2.1.11 Build 20260723 Rel.41624
(custom)
|
|
| TP-Link Systems Inc. | ER706WP-4G v1 |
Affected:
0 , < 1.1.11 Build 20260723 Rel.41624
(custom)
|
|
| TP-Link Systems Inc. | ER703WP-4G-Outdoor v1 |
Affected:
0 , < 1.1.7 Build 20260723 Rel.41712
(custom)
|
|
| TP-Link Systems Inc. | DR3220v-4G v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.82652
(custom)
|
|
| TP-Link Systems Inc. | DR3650v v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.83311
(custom)
|
|
| TP-Link Systems Inc. | DR3650v-4G v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.83347
(custom)
|
|
| TP-Link Systems Inc. | ER603WP-4G-Outdoor v1 |
Affected:
0 , < 1.0.2 Build 20260723 Rel.43271
(custom)
|
|
| TP-Link Systems Inc. | DR3150 v1 |
Affected:
0 , < 1.0.1 Build 20260722 Rel.16854
(custom)
|
|
| TP-Link Systems Inc. | ER701-5G-Outdoor v1 |
Affected:
0 , < 1.0.3 Build 20260723 Rel.40931
(custom)
|
|
| TP-Link Systems Inc. | ER605W v2 |
Affected:
0 , < 2.0.4 Build 20260723 Rel.43763
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19586",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T03:56:42.164Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ER7212PC v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.4.3 Build 20260722 Rel.40250",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER605 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.4.4 Build 20260630 Rel.14398",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7206 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.3.5 Build 20260625 Rel.43136",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7406 v1",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"lessThan": "1.3.4 Build 20260625 Rel.43136",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER707-M2 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.4 Build 20260625 Rel.43063",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7412-M2 v1",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.82947",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER8411 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.1 Build 20260708 Rel.64832",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706W v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.11 Build 20260723 Rel.41567",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.6 Build 20260723 Rel.41321",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706W-4G v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.1.11 Build 20260723 Rel.41624",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706WP-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.11 Build 20260723 Rel.41624",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER703WP-4G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.7 Build 20260723 Rel.41712",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3220v-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.82652",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3650v v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.83311",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3650v-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.83347",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER603WP-4G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.2 Build 20260723 Rel.43271",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3150 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.1 Build 20260722 Rel.16854",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER701-5G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.3 Build 20260723 Rel.40931",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER605W v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.0.4 Build 20260723 Rel.43763",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matt Graham (mattg.systems)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.\u0026nbsp;\u003c/p\u003e\u003cp\u003eSuccessful exploitation may allow arbitrary command execution,\u0026nbsp;\u003cspan\u003epotentially\nleading to full compromise of the affected device.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.\u00a0\n\n\n\nSuccessful exploitation may allow arbitrary command execution,\u00a0potentially\nleading to full compromise of the affected device."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T16:10:43.693Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"name": "Omada Gateway Firmware Downloads (EN)",
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/en/support/download/"
},
{
"name": "Omada Gateway Firmware Downloads (US)",
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/us/support/download/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5256/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://mattg.systems/posts/cve-2026-19586/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-19586",
"datePublished": "2026-08-20T18:32:06.942Z",
"dateReserved": "2026-08-12T00:06:23.069Z",
"dateUpdated": "2026-08-28T16:10:43.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9033 (GCVE-0-2026-9033)
Vulnerability from cvelistv5 – Published: 2026-08-20 18:31 – Updated: 2026-08-20 18:59
VLAI
EPSS
VEX
Title
Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways
Summary
An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.
Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 18:59 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.omadanetworks.com/en/support/download/ | patch |
| https://www.omadanetworks.com/us/support/download/ | patch |
| https://www.tp-link.com/us/support/faq/5256/ | vendor-advisory |
Impacted products
19 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | ER7212PC v2 |
Affected:
0 , < 2.4.3 Build 20260722 Rel.40250
(custom)
|
|
| TP-Link Systems Inc. | ER605 v2 |
Affected:
0 , < 2.4.4 Build 20260630 Rel.14398
(custom)
|
|
| TP-Link Systems Inc. | ER7206 v2 |
Affected:
0 , < 2.3.5 Build 20260625 Rel.43136
(custom)
|
|
| TP-Link Systems Inc | ER7406 v1 |
Affected:
0 , < 1.3.4 Build 20260625 Rel.43136
(custom)
|
|
| TP-Link Systems Inc. | ER707-M2 v1 |
Affected:
0 , < 1.4.4 Build 20260625 Rel.43063
(custom)
|
|
| TP-Link Systems Inc | ER7412-M2 v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.82947
(custom)
|
|
| TP-Link Systems Inc. | ER8411 v1 |
Affected:
0 , < 1.4.1 Build 20260708 Rel.64832
(custom)
|
|
| TP-Link Systems Inc. | ER706W v1 |
Affected:
0 , < 1.2.11 Build 20260723 Rel.41567
(custom)
|
|
| TP-Link Systems Inc. | ER706W-4G v1 |
Affected:
0 , < 1.2.6 Build 20260723 Rel.41321
(custom)
|
|
| TP-Link Systems Inc. | ER706W-4G v2 |
Affected:
0 , < 2.1.11 Build 20260723 Rel.41624
(custom)
|
|
| TP-Link Systems Inc. | ER706WP-4G v1 |
Affected:
0 , < 1.1.11 Build 20260723 Rel.41624
(custom)
|
|
| TP-Link Systems Inc. | ER703WP-4G-Outdoor v1 |
Affected:
0 , < 1.1.7 Build 20260723 Rel.41712
(custom)
|
|
| TP-Link Systems Inc. | DR3220v-4G v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.82652
(custom)
|
|
| TP-Link Systems Inc. | DR3650v v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.83311
(custom)
|
|
| TP-Link Systems Inc. | DR3650v-4G v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.83347
(custom)
|
|
| TP-Link Systems Inc. | ER603WP-4G-Outdoor v1 |
Affected:
0 , < 1.0.2 Build 20260723 Rel.43271
(custom)
|
|
| TP-Link Systems Inc. | DR3150 v1 |
Affected:
0 , < 1.0.1 Build 20260722 Rel.16854
(custom)
|
|
| TP-Link Systems Inc. | ER701-5G-Outdoor v1 |
Affected:
0 , < 1.0.3 Build 20260723 Rel.40931
(custom)
|
|
| TP-Link Systems Inc. | ER605W v2 |
Affected:
0 , < 2.0.4 Build 20260723 Rel.43763
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9033",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T18:59:29.032581Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:59:36.657Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ER7212PC v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.4.3 Build 20260722 Rel.40250",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER605 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.4.4 Build 20260630 Rel.14398",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7206 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.3.5 Build 20260625 Rel.43136",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7406 v1",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"lessThan": "1.3.4 Build 20260625 Rel.43136",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER707-M2 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.4 Build 20260625 Rel.43063",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7412-M2 v1",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.82947",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER8411 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.1 Build 20260708 Rel.64832",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706W v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.11 Build 20260723 Rel.41567",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706W-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.6 Build 20260723 Rel.41321",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706W-4G v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.1.11 Build 20260723 Rel.41624",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706WP-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.11 Build 20260723 Rel.41624",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER703WP-4G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.7 Build 20260723 Rel.41712",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3220v-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.82652",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3650v v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.83311",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3650v-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.83347",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER603WP-4G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.2 Build 20260723 Rel.43271",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3150 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.1 Build 20260722 Rel.16854",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER701-5G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.3 Build 20260723 Rel.40931",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER605W v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.0.4 Build 20260723 Rel.43763",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yoontae Lee (@yunttai)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.\u0026nbsp;\u003c/p\u003e\u003cp\u003eSuccessful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.\u003c/p\u003e"
}
],
"value": "An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.\u00a0\n\n\n\nSuccessful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:31:54.806Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"name": "Omada Gateway Firmware Downloads (EN)",
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/en/support/download/"
},
{
"name": "Omada Gateway Firmware Downloads (US)",
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/us/support/download/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5256/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-9033",
"datePublished": "2026-08-20T18:31:54.806Z",
"dateReserved": "2026-05-19T16:30:37.346Z",
"dateUpdated": "2026-08-20T18:59:36.657Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-9290 (GCVE-0-2025-9290)
Vulnerability from cvelistv5 – Published: 2026-01-22 23:14 – Updated: 2026-01-23 20:04
VLAI
EPSS
VEX
Title
Authentication Weakness on Omada Controllers, Gateways and Access Points
Summary
An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-23 20:04 UTC
CWE
- CWE-760 - Use of a One-Way Hash with a Predictable Salt
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://support.omadanetworks.com/us/download/ | patch |
| https://support.omadanetworks.com/en/download/ | patch |
| https://support.omadanetworks.com/us/document/114950/ | vendor-advisory |
Impacted products
30 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9290",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-23T20:04:16.930287Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-23T20:04:29.976Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"Linux"
],
"product": "Omada Software Controller",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "6.0.0.24",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Cloud Controller",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "6.0.0.100",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Hardware Controller (OC200, OC300, OC400)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "6.0.0.34",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Hardware Controller OC220",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "5.15.24",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway (ER605 v2.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.3.2 Build 20251029 Rel.12727",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway (ER7206 v2.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.2.2 Build 20250724 Rel.11109",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway (ER7406, ER706W, ER706-4G)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.x",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway (ER707-M2, ER-8411)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.3.x",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway (ER7412-M2, ER706WP-4G, ER703WP-4G-Outdoor, DR3220v-4G, DR3650v, DR3650v-4G)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway (ER8411)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.3.5 Build 20251028 Rel.06811",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway (ER706W-4G 2.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.1.0 Build 20250810 Rel.77020",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway (ER701-5G-Outdoor)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.0 Build 20250826 Rel.68862",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway (ER605W 2.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.0.2 Build 20250723 Rel.39048",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway ER7212PC 2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.2.1 Build 20251027 Rel.75129",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Festa Gateway FR365",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.10 Build 20250626 Rel.81746",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Gateway G36W-4G",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.5 Build 20250710 Rel.62142",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP660 HD v1.0/v2.0, EAP620 HD v2.0/v3.0/v3.20, EAP610/EAP610-Outdoor v1.0/v2.0, EAP623-Outdoor HD v1.0, EAP625-Outdoor HD v1.0)EAP",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.6.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP655-Wall v1.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.6.2 Build 20251107 Rel.35700",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP772 v1.0, EAP773 v1.0, EAP783 v1.0, EAP787 v1.0, EAP720 v1.0, EAP725-Wall v1.0, EAp723 v2.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP723 v1.0, EAP772 v2.0, EAP772-Outdoor v 1.0, EAP770 v2.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.3.2 Build 20250901 Rel.52255",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP215 Bridge KIT 3.0, EAP211 Bridge KIT 3.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.4 Build 20251112 Rel.34769",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Beam Bridge 5 UR v1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.5 Build 20250928 Rel.68499",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP603GP-Desktop, EAP615GP-Wall 1.0/1.20, EAP625GP-Wall 1.0/1.20, EAP610GP-Desktop 1.0/1.20/1.26), EAP650-Desktop v1.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP650GP-Desktop 1.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.1 Build 20250819 Rel.60298",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP653 v1.0, EAP650-Outdoor v1.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.3.3 Build 20251111 Rel.72627",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP230-Wall v1.0, EAP235-Wall v1.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "3.3.1 Build 20251203 Rel.58135",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP603-Outdoor v1.0, EAP615-Wall v1.0/v1.20)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.5.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP653 UR v1.0)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.2 Build 20251208 Rel.43830",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Point (EAP615-Wall v1.0/v1.20)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.5.10 Build 20250903 Rel.49784",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada EAP100-Bridge KIT v1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.3 Build 20251015 Rel.62058",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Stanislav Dashevskyi and Francesco La Spina of Forescout Technologies"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality."
}
],
"value": "An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality."
}
],
"impacts": [
{
"capecId": "CAPEC-112",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-112 Brute Force"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-760",
"description": "CWE-760 Use of a One-Way Hash with a Predictable Salt",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-22T23:14:45.823Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://support.omadanetworks.com/us/download/"
},
{
"tags": [
"patch"
],
"url": "https://support.omadanetworks.com/en/download/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://support.omadanetworks.com/us/document/114950/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authentication Weakness on Omada Controllers, Gateways and Access Points",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2025-9290",
"datePublished": "2026-01-22T23:14:45.823Z",
"dateReserved": "2025-08-20T22:24:20.340Z",
"dateUpdated": "2026-01-23T20:04:29.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}