Search
Find a vulnerability
Search criteria
175 vulnerabilities
CVE-2026-76784 (GCVE-0-2026-76784)
Vulnerability from cvelistv5 – Published: 2026-08-26 17:47 – Updated: 2026-08-26 18:50
VLAI
EPSS
VEX
Title
Insufficient Cryptographic Protections in Local Device Communication Protocol on Multiple TP-Link Kasa Smart Home Devices
Summary
Multiple
TP-Link Kasa smart home devices contain insufficient cryptographic protections
in the local device communication protocol. An adjacent network attacker may
intercept, replay or forge locally exchanged control messages, potentially
resulting in unauthorized device control.
Successful
exploitation could allow an attacker to manipulate the operational state of an
affected device, resulting in unauthorized state changes, disruption of normal
device functionality or a denial-of-service condition.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 18:43 UTC
CWE
- CWE-325 - Missing Cryptographic Step
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.tp-link.com/us/support/download/ | patch |
| https://www.tp-link.com/en/support/download/ | patch |
| https://www.tp-link.com/in/support/download/ | patch |
| https://www.tp-link.com/us/support/faq/5267/ | vendor-advisory |
Impacted products
20 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | HS103P3 / HS103P4 v5 |
Affected:
0 , < 1.1.3 Build 250908 Rel.112508
(custom)
|
|
| TP-Link Systems Inc. | EP10 |
Affected:
0 , < 1.1.1 Build 250908 Rel.112508
(custom)
|
|
| TP-Link Systems Inc. | EP25 V2 |
Affected:
0 , < 1.0.3 Build 240529 Rel.145252
(custom)
|
|
| TP-Link Systems Inc. | HS300 V2 |
Affected:
0 , < 1.1.2 Build 241220 Rel.171333
(custom)
|
|
| TP-Link Systems Inc. | KP303 V2 |
Affected:
0 , < 1.1.2 Build 241220 Rel.173321
(custom)
|
|
| TP-Link Systems Inc. | EP40A |
Affected:
0 , < 1.1.1 Build 250908 Rel.112526
(custom)
|
|
| TP-Link Systems Inc. | KP125MP2 / KP125MP4 |
Affected:
0 , < 1.2.5 Build 241213 Rel.172504
(custom)
|
|
| TP-Link Systems Inc. | KP115 |
Affected:
0 , < 1.1.1 Build 250908 Rel.112945
(custom)
|
|
| TP-Link Systems Inc. | KS225 |
Affected:
0 , < 1.1.1 Build 240626 Rel.175125
(custom)
|
|
| TP-Link Systems Inc. | EP40M |
Affected:
0 , < 1.1.0 Build 240415 Rel.171219
(custom)
|
|
| TP-Link Systems Inc. | KS205 |
Affected:
0 , < 1.1.1 Build 240724 Rel.105920
(custom)
|
|
| TP-Link Systems Inc. | KS240 |
Affected:
0 , < 1.0.6 Build 240122 Rel.160100
(custom)
|
|
| TP-Link Systems Inc. | ES20M |
Affected:
0 , < 1.1.6 Build 250522 Rel.210254
(custom)
|
|
| TP-Link Systems Inc. | KS220M |
Affected:
0 , < 1.1.6 Build 250522 Rel.210254
(custom)
|
|
| TP-Link Systems Inc. | KP200 V3 |
Affected:
0 , < 1.1.0 Build 250225 Rel.171724
(custom)
|
|
| TP-Link Systems Inc. | HS200 V5.26 |
Affected:
0 , < 1.0.3 Build 240723 Rel.192622
(custom)
|
|
| TP-Link Systems Inc. | HS220-LA(US) 6.6 / HS220-BL(US) 6.6 |
Affected:
0 , < 1.0.3 Build 240723 Rel.192630
(custom)
|
|
| TP-Link Systems Inc. | HS220 V3.26 |
Affected:
0 , < 1.1.1 Build 240802 Rel.094131
(custom)
|
|
| TP-Link Systems Inc. | HS220-LA(US) 4.6 / HS220-BL(US) 4.6 |
Affected:
0 , < 1.1.1 Build 240802 Rel.094142
(custom)
|
|
| TP-Link Systems Inc. | KL125 |
Affected:
0 , < 1.1.1 Build 260710 Rel.082646
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76784",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T18:43:28.394552Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T18:50:19.860Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HS103P3 / HS103P4 v5",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.3 Build 250908 Rel.112508",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EP10",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.1 Build 250908 Rel.112508",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EP25 V2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.3 Build 240529 Rel.145252",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HS300 V2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.2 Build 241220 Rel.171333",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "KP303 V2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.2 Build 241220 Rel.173321",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EP40A",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.1 Build 250908 Rel.112526",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "KP125MP2 / KP125MP4",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.5 Build 241213 Rel.172504",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "KP115",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.1 Build 250908 Rel.112945",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "KS225",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.1 Build 240626 Rel.175125",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EP40M",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.0 Build 240415 Rel.171219",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "KS205",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.1 Build 240724 Rel.105920",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "KS240",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.6 Build 240122 Rel.160100",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ES20M",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.6 Build 250522 Rel.210254",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "KS220M",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.6 Build 250522 Rel.210254",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "KP200 V3",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.0 Build 250225 Rel.171724",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HS200 V5.26",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.3 Build 240723 Rel.192622",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HS220-LA(US) 6.6 / HS220-BL(US) 6.6",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.3 Build 240723 Rel.192630",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HS220 V3.26",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.1 Build 240802 Rel.094131",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HS220-LA(US) 4.6 / HS220-BL(US) 4.6",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.1 Build 240802 Rel.094142",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "KL125",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.1 Build 260710 Rel.082646",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Priyanka Rushikesh Chaudhary (Research Scholar, CSIS Department, BITS Pilani, Hyderabad Campus, India), Rajib Ranjan Maiti (Associate Professor, CSIS Department, BITS Pilani, Hyderabad Campus, India)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMultiple\nTP-Link Kasa smart home devices contain insufficient cryptographic protections\nin the local device communication protocol. An adjacent network attacker may\nintercept, replay or forge locally exchanged control messages, potentially\nresulting in unauthorized device control. \u003c/p\u003e\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eSuccessful\nexploitation could allow an attacker to manipulate the operational state of an\naffected device, resulting in unauthorized state changes, disruption of normal\ndevice functionality or a denial-of-service condition.\u003c/p\u003e"
}
],
"value": "Multiple\nTP-Link Kasa smart home devices contain insufficient cryptographic protections\nin the local device communication protocol. An adjacent network attacker may\nintercept, replay or forge locally exchanged control messages, potentially\nresulting in unauthorized device control. \n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation could allow an attacker to manipulate the operational state of an\naffected device, resulting in unauthorized state changes, disruption of normal\ndevice functionality or a denial-of-service condition."
}
],
"impacts": [
{
"capecId": "CAPEC-594",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-594 Traffic Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-325",
"description": "CWE-325: Missing Cryptographic Step",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T17:47:54.278Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/in/support/download/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5267/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Insufficient Cryptographic Protections in Local Device Communication Protocol on Multiple TP-Link Kasa Smart Home Devices",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-76784",
"datePublished": "2026-08-26T17:47:54.278Z",
"dateReserved": "2026-08-19T17:32:21.874Z",
"dateUpdated": "2026-08-26T18:50:19.860Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78541 (GCVE-0-2026-78541)
Vulnerability from cvelistv5 – Published: 2026-08-24 18:26 – Updated: 2026-08-25 03:56
VLAI
EPSS
VEX
Title
Command Injection in Parent Control of TP-Link Archer BE3600 v1
Summary
A stored OS
command injection vulnerability exists in the parent-control module of TP-Link
Archer BE3600 V1. An authenticated adjacent attacker with administrative access
may store a crafted profile name containing shell metacharacters, which is
later processed unsafely during daily cloud report generation and may result in
arbitrary command execution.
Successful
exploitation may allow command execution on the affected device with potential
impact to device confidentiality, integrity, and availability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 00:00 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.tp-link.com/us/support/download/arche… | patch |
| https://www.tp-link.com/en/support/download/arche… | patch |
| https://www.tp-link.com/us/support/faq/5264/ | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | Archer BE3600 v1 |
Affected:
0 , < 1.2.6 Build 20260617
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78541",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T03:56:57.446Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"parent-control"
],
"product": "Archer BE3600 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.6 Build 20260617",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sungmin Kang (rauzn), JeroScope"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA stored OS\ncommand injection vulnerability exists in the parent-control module of TP-Link\nArcher BE3600 V1. An authenticated adjacent attacker with administrative access\nmay store a crafted profile name containing shell metacharacters, which is\nlater processed unsafely during daily cloud report generation and may result in\narbitrary command execution.\u003c/p\u003e\n\n\u003cp\u003eSuccessful\nexploitation may allow command execution on the affected device with potential\nimpact to device confidentiality, integrity, and availability.\u003c/p\u003e"
}
],
"value": "A stored OS\ncommand injection vulnerability exists in the parent-control module of TP-Link\nArcher BE3600 V1. An authenticated adjacent attacker with administrative access\nmay store a crafted profile name containing shell metacharacters, which is\nlater processed unsafely during daily cloud report generation and may result in\narbitrary command execution.\n\n\n\n\n\nSuccessful\nexploitation may allow command execution on the affected device with potential\nimpact to device confidentiality, integrity, and availability."
}
],
"impacts": [
{
"capecId": "CAPEC-248",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-248 Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T18:26:11.670Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/archer-be3600/v1.26/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/archer-be3600/v1/#Firmware"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5264/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Command Injection in Parent Control of TP-Link Archer BE3600 v1",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-78541",
"datePublished": "2026-08-24T18:26:11.670Z",
"dateReserved": "2026-08-24T17:49:50.653Z",
"dateUpdated": "2026-08-25T03:56:57.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16348 (GCVE-0-2026-16348)
Vulnerability from cvelistv5 – Published: 2026-08-24 17:25 – Updated: 2026-08-25 03:56
VLAI
EPSS
VEX
Title
Command Injection Vulnerability in VPN connection of Archer BE800
Summary
An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection.
Successful exploitation may enable persistent backdoors, credential theft, LAN reconnaissance, and router-assisted attacks against connected devices.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 00:00 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.tp-link.com/us/support/download/arche… | patch |
| https://www.tp-link.com/en/support/download/arche… | patch |
| https://www.tp-link.com/us/support/faq/5264/ | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | Archer BE800 v1 |
Affected:
0 , < 1.4.2 Build 260708
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16348",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T03:56:53.071Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"vpn connection"
],
"product": "Archer BE800 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.2 Build 260708",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sean Lagan, UploadSecurity"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eAn authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection.\u0026nbsp;\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eSuccessful exploitation may enable persistent backdoors, credential theft, LAN reconnaissance, and router-assisted attacks against connected devices.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection.\u00a0\n\n\n\n\nSuccessful exploitation may enable persistent backdoors, credential theft, LAN reconnaissance, and router-assisted attacks against connected devices."
}
],
"impacts": [
{
"capecId": "CAPEC-248",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-248 Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T17:25:46.598Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/archer-be800/v1/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/archer-be800/v1/#Firmware"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5264/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Command Injection Vulnerability in VPN connection of Archer BE800",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-16348",
"datePublished": "2026-08-24T17:25:46.598Z",
"dateReserved": "2026-07-20T21:48:41.382Z",
"dateUpdated": "2026-08-25T03:56:53.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9254 (GCVE-0-2026-9254)
Vulnerability from cvelistv5 – Published: 2026-08-24 17:25 – Updated: 2026-08-25 03:56
VLAI
EPSS
VEX
Title
Command Injection Vulnerability in Parent Control of Multiple TP-Link Archer Devices
Summary
An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inject arbitrary commands and execute them with root privileges.
Successful exploitation may result in complete device compromise and impact the confidentiality, integrity, and availability of the affected device and network traffic.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 00:00 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
8 references
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | Archer BE800 V1 |
Affected:
0 , < 1.4.2 Build 260708
(custom)
|
|
| TP-Link Systems Inc. | Archer BE3600 V1 |
Affected:
0 , < 1.2.6 Build 20260617
(custom)
|
|
| TP-Link Systems Inc. | Archer AX75 V1 |
Affected:
0 , < 1.1.6 Build 260716
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9254",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T03:56:51.934Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"parent control"
],
"product": "Archer BE800 V1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.2 Build 260708",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"parent control"
],
"product": "Archer BE3600 V1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.6 Build 20260617",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"parent control"
],
"product": "Archer AX75 V1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.6 Build 260716",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sean Lagan, UploadSecurity"
},
{
"lang": "en",
"type": "finder",
"value": "Sungmin Kang (rauzn), JeroScope"
},
{
"lang": "en",
"type": "finder",
"value": "Sergio Medeiros (grumpz)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eAn unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inject arbitrary commands and execute them with root privileges.\u003c/div\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e\u003cdiv\u003eSuccessful exploitation may result in complete device compromise and impact the confidentiality, integrity, and availability of the affected device and network traffic.\u003c/div\u003e"
}
],
"value": "An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inject arbitrary commands and execute them with root privileges.\n\n\n\n\n\n\nSuccessful exploitation may result in complete device compromise and impact the confidentiality, integrity, and availability of the affected device and network traffic."
}
],
"impacts": [
{
"capecId": "CAPEC-248",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-248 Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T17:25:30.486Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/archer-be800/v1/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/archer-be800/v1/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/archer-be3600/v1/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/archer-be3600/v1/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/kr/support/download/archer-be3600/v1/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/archer-ax75/v1/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/archer-ax75/v1/#Firmware"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5264/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Command Injection Vulnerability in Parent Control of Multiple TP-Link Archer Devices",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-9254",
"datePublished": "2026-08-24T17:25:30.486Z",
"dateReserved": "2026-05-21T20:23:27.422Z",
"dateUpdated": "2026-08-25T03:56:51.934Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15469 (GCVE-0-2026-15469)
Vulnerability from cvelistv5 – Published: 2026-08-24 16:32 – Updated: 2026-08-24 18:00
VLAI
EPSS
VEX
Title
Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800
Summary
The use of
hard-coded cryptographic key vulnerability has been identified in the mesh
functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6.
A shared RSA-512 mesh group private key is present in the affected
firmware and is used by the mesh protocol for node authentication. An attacker who obtains the firmware image
and has local network access may be able to authenticate as a mesh node without
possessing a device-specific credential.
Successful
exploitation may allow an unauthenticated adjacent attacker to impersonate a
trusted mesh node and bypass mesh node authentication, which may permit unauthorized
changes to device or mesh configuration, affecting confidentiality, integrity
and availability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 17:25 UTC
CWE
- CWE-321 - Use of hard-coded cryptographic key
Assigner
References
5 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | Deco XE75 v3 / XE5300 v3.6/ WE10800 v3.6 |
Affected:
0 , < 1.5.0 Build 20260603
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15469",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T17:25:18.245788Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T17:25:22.871Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"mesh"
],
"product": "Deco XE75 v3 / XE5300 v3.6/ WE10800 v3.6",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.5.0 Build 20260603",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Junsung Ahn"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe use of\nhard-coded cryptographic key vulnerability has been identified in the mesh\nfunctionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6.\u0026nbsp;\nA shared RSA-512 mesh group private key is present in the affected\nfirmware and is used by the mesh protocol for node authentication.\u0026nbsp; An attacker who obtains the firmware image\nand has local network access may be able to authenticate as a mesh node without\npossessing a device-specific credential.\u003c/p\u003e\n\n\u003cp\u003eSuccessful\nexploitation may allow an unauthenticated adjacent attacker to impersonate a\ntrusted mesh node and bypass mesh node authentication, which may permit unauthorized\nchanges to device or mesh configuration, affecting confidentiality, integrity\nand availability.\u003c/p\u003e"
}
],
"value": "The use of\nhard-coded cryptographic key vulnerability has been identified in the mesh\nfunctionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6.\u00a0\nA shared RSA-512 mesh group private key is present in the affected\nfirmware and is used by the mesh protocol for node authentication.\u00a0 An attacker who obtains the firmware image\nand has local network access may be able to authenticate as a mesh node without\npossessing a device-specific credential.\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated adjacent attacker to impersonate a\ntrusted mesh node and bypass mesh node authentication, which may permit unauthorized\nchanges to device or mesh configuration, affecting confidentiality, integrity\nand availability."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321 Use of hard-coded cryptographic key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T18:00:49.583Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/deco-xe75/v3.60/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/deco-xe75/v3.60/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/deco-xe5300/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/deco-we10800/#Firmware"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5263/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-15469",
"datePublished": "2026-08-24T16:32:12.573Z",
"dateReserved": "2026-07-10T22:04:23.852Z",
"dateUpdated": "2026-08-24T18:00:49.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17252 (GCVE-0-2026-17252)
Vulnerability from cvelistv5 – Published: 2026-08-21 17:16 – Updated: 2026-08-25 22:45
VLAI
EPSS
VEX
Title
Unauthenticated Denial of Service via Composed HTTP Parsing and Stack-Based Out-of-Bounds Write Vulnerability in TL-MR6400 Web Management Interface
Summary
A
stack-based out-of-bounds write vulnerability exists in the login request
handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability
by sending a specially crafted malformed HTTP request.
Successful
exploitation may cause the web service process to crash, resulting in a
denial-of-service condition and temporary loss of access to the router's web
management interface.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 17:38 UTC
CWE
- CWE-787 - Out-of-bounds write
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.tp-link.com/en/support/download/tl-mr… | patch |
| https://www.tp-link.com/tw/support/download/tl-mr… | patch |
| https://www.tp-link.com/us/support/faq/5259/ | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | TL-MR6400 v7.0 |
Affected:
0 , < 1.9.0 Build 260714
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17252",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T17:38:28.929657Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T17:38:36.456Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TL-MR6400 v7.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.9.0 Build 260714",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA\nstack-based out-of-bounds write vulnerability exists in the login request\nhandling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability\nby sending a specially crafted malformed HTTP request. \u003c/p\u003e\n\n\u003cp\u003eSuccessful\nexploitation may cause the web service process to crash, resulting in a\ndenial-of-service condition and temporary loss of access to the router\u0027s web\nmanagement interface.\u003c/p\u003e"
}
],
"value": "A\nstack-based out-of-bounds write vulnerability exists in the login request\nhandling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability\nby sending a specially crafted malformed HTTP request. \n\n\n\n\n\nSuccessful\nexploitation may cause the web service process to crash, resulting in a\ndenial-of-service condition and temporary loss of access to the router\u0027s web\nmanagement interface."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T22:45:36.155Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/tl-mr6400/v7/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/tw/support/download/tl-mr6400/v7/#Firmware"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5259/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Denial of Service via Composed HTTP Parsing and Stack-Based Out-of-Bounds Write Vulnerability in TL-MR6400 Web Management Interface",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-17252",
"datePublished": "2026-08-21T17:16:51.552Z",
"dateReserved": "2026-07-24T22:03:13.178Z",
"dateUpdated": "2026-08-25T22:45:36.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17251 (GCVE-0-2026-17251)
Vulnerability from cvelistv5 – Published: 2026-08-21 17:16 – Updated: 2026-08-21 17:40
VLAI
EPSS
VEX
Title
Unauthenticated Denial of Service via Null Pointer Dereference in HTTP Request Parsing
Summary
A NULL
pointer dereference vulnerability exists in the HTTP request parsing
functionality of
TL-MR6400 v7. An unauthenticated remote attacker can
trigger the vulnerability by sending a specially crafted HTTP request
containing a malformed session cookie header.
Successful
exploitation may cause the HTTP service process to crash, resulting in a
denial-of-service condition and temporary loss of management or CGI
functionality until service recovery.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 17:40 UTC
CWE
- CWE-476 - NULL pointer dereference
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.tp-link.com/en/support/download/tl-mr… | patch |
| https://www.tp-link.com/tw/support/download/tl-mr… | patch |
| https://www.tp-link.com/us/support/faq/5259/ | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | TL-MR6400 v7.0 |
Affected:
0 , < 1.9.0 Build 260714
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17251",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T17:40:25.485077Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T17:40:36.098Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "TL-MR6400 v7.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.9.0 Build 260714",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Rui Cheng Yu (Hina)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA NULL\npointer dereference vulnerability exists in the HTTP request parsing\nfunctionality of\u0026nbsp;\nTL-MR6400 v7. An unauthenticated remote attacker can\ntrigger the vulnerability by sending a specially crafted HTTP request\ncontaining a malformed session cookie header. \u003c/p\u003e\n\n\u003cp\u003eSuccessful\nexploitation may cause the HTTP service process to crash, resulting in a\ndenial-of-service condition and temporary loss of management or CGI\nfunctionality until service recovery.\u003c/p\u003e"
}
],
"value": "A NULL\npointer dereference vulnerability exists in the HTTP request parsing\nfunctionality of\u00a0\nTL-MR6400 v7. An unauthenticated remote attacker can\ntrigger the vulnerability by sending a specially crafted HTTP request\ncontaining a malformed session cookie header. \n\n\n\n\n\nSuccessful\nexploitation may cause the HTTP service process to crash, resulting in a\ndenial-of-service condition and temporary loss of management or CGI\nfunctionality until service recovery."
}
],
"impacts": [
{
"capecId": "CAPEC-135",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-135 Format String Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL pointer dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T17:16:45.791Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/tl-mr6400/v7/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/tw/support/download/tl-mr6400/v7/#Firmware"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5259/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Denial of Service via Null Pointer Dereference in HTTP Request Parsing",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-17251",
"datePublished": "2026-08-21T17:16:45.791Z",
"dateReserved": "2026-07-24T22:03:11.872Z",
"dateUpdated": "2026-08-21T17:40:36.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17250 (GCVE-0-2026-17250)
Vulnerability from cvelistv5 – Published: 2026-08-21 17:16 – Updated: 2026-08-25 03:56
VLAI
EPSS
VEX
Title
Authenticated Remote Code Execution via Stack-Based Buffer Overflow in Firmware Update Handling
Summary
A
stack-based buffer overflow vulnerability exists in the firmware update
functionality of TL-MR6400 v7 due to unsafe processing of
attacker-controlled metadata within a firmware image.
Successful
exploitation may allow an authenticated attacker to trigger memory corruption
and execute arbitrary code on the affected device.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 00:00 UTC
CWE
- CWE-121 - Stack-based buffer overflow
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.tp-link.com/en/support/download/tl-mr… | patch |
| https://www.tp-link.com/tw/support/download/tl-mr… | patch |
| https://www.tp-link.com/us/support/faq/5259/ | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | TL-MR6400 v7.0 |
Affected:
0 , < 1.9.0 Build 260714
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17250",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T03:56:42.953Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "TL-MR6400 v7.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.9.0 Build 260714",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Rui Cheng Yu (Hina)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA\nstack-based buffer overflow vulnerability exists in the firmware update\nfunctionality of TL-MR6400 v7 due to unsafe processing of\nattacker-controlled metadata within a firmware image. \u003c/p\u003e\n\n\u003cp\u003eSuccessful\nexploitation may allow an authenticated attacker to trigger memory corruption\nand execute arbitrary code on the affected device.\u003c/p\u003e"
}
],
"value": "A\nstack-based buffer overflow vulnerability exists in the firmware update\nfunctionality of TL-MR6400 v7 due to unsafe processing of\nattacker-controlled metadata within a firmware image. \n\n\n\n\n\nSuccessful\nexploitation may allow an authenticated attacker to trigger memory corruption\nand execute arbitrary code on the affected device."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T17:16:38.888Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/tl-mr6400/v7/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/tw/support/download/tl-mr6400/v7/#Firmware"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5259/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated Remote Code Execution via Stack-Based Buffer Overflow in Firmware Update Handling",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-17250",
"datePublished": "2026-08-21T17:16:38.888Z",
"dateReserved": "2026-07-24T22:03:10.608Z",
"dateUpdated": "2026-08-25T03:56:42.953Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19683 (GCVE-0-2026-19683)
Vulnerability from cvelistv5 – Published: 2026-08-20 18:32 – Updated: 2026-08-20 18:58
VLAI
EPSS
VEX
Title
Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways
Summary
A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path.
Successful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 18:55 UTC
CWE
- CWE-319 - Cleartext transmission of sensitive information
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.omadanetworks.com/en/support/download/ | patch |
| https://www.omadanetworks.com/us/support/download/ | patch |
| https://www.tp-link.com/us/support/faq/5256/ | vendor-advisory |
Impacted products
19 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | ER7212PC v2 |
Affected:
0 , < 2.4.3 Build 20260722 Rel.40250
(custom)
|
|
| TP-Link Systems Inc. | ER605 v2 |
Affected:
0 , < 2.4.4 Build 20260630 Rel.14398
(custom)
|
|
| TP-Link Systems Inc. | ER7206 v2 |
Affected:
0 , < 2.3.5 Build 20260625 Rel.43136
(custom)
|
|
| TP-Link Systems Inc | ER7406 v1 |
Affected:
0 , < 1.3.4 Build 20260625 Rel.43136
(custom)
|
|
| TP-Link Systems Inc. | ER707-M2 v1 |
Affected:
0 , < 1.4.4 Build 20260625 Rel.43063
(custom)
|
|
| TP-Link Systems Inc | ER7412-M2 v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.82947
(custom)
|
|
| TP-Link Systems Inc. | ER8411 v1 |
Affected:
0 , < 1.4.1 Build 20260708 Rel.64832
(custom)
|
|
| TP-Link Systems Inc. | ER706W v1 |
Affected:
0 , < 1.2.11 Build 20260723 Rel.41567
(custom)
|
|
| TP-Link Systems Inc. | v1 |
Affected:
0 , < 1.2.6 Build 20260723 Rel.41321
(custom)
|
|
| TP-Link Systems Inc. | ER706W-4G v2 |
Affected:
0 , < 2.1.11 Build 20260723 Rel.41624
(custom)
|
|
| TP-Link Systems Inc. | ER706WP-4G v1 |
Affected:
0 , < 1.1.11 Build 20260723 Rel.41624
(custom)
|
|
| TP-Link Systems Inc. | ER703WP-4G-Outdoor v1 |
Affected:
0 , < 1.1.7 Build 20260723 Rel.41712
(custom)
|
|
| TP-Link Systems Inc. | DR3220v-4G v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.82652
(custom)
|
|
| TP-Link Systems Inc. | DR3650v v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.83311
(custom)
|
|
| TP-Link Systems Inc. | DR3650v-4G v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.83347
(custom)
|
|
| TP-Link Systems Inc. | ER603WP-4G-Outdoor v1 |
Affected:
0 , < 1.0.2 Build 20260723 Rel.43271
(custom)
|
|
| TP-Link Systems Inc. | DR3150 v1 |
Affected:
0 , < 1.0.1 Build 20260722 Rel.16854
(custom)
|
|
| TP-Link Systems Inc. | ER701-5G-Outdoor v1 |
Affected:
0 , < 1.0.3 Build 20260723 Rel.40931
(custom)
|
|
| TP-Link Systems Inc. | ER605W v2 |
Affected:
0 , < 2.0.4 Build 20260723 Rel.43763
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19683",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T18:55:44.295305Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:58:42.948Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ER7212PC v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.4.3 Build 20260722 Rel.40250",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER605 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.4.4 Build 20260630 Rel.14398",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7206 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.3.5 Build 20260625 Rel.43136",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7406 v1",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"lessThan": "1.3.4 Build 20260625 Rel.43136",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER707-M2 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.4 Build 20260625 Rel.43063",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7412-M2 v1",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.82947",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER8411 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.1 Build 20260708 Rel.64832",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706W v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.11 Build 20260723 Rel.41567",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.6 Build 20260723 Rel.41321",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706W-4G v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.1.11 Build 20260723 Rel.41624",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706WP-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.11 Build 20260723 Rel.41624",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER703WP-4G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.7 Build 20260723 Rel.41712",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3220v-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.82652",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3650v v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.83311",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3650v-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.83347",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER603WP-4G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.2 Build 20260723 Rel.43271",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3150 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.1 Build 20260722 Rel.16854",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER701-5G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.3 Build 20260723 Rel.40931",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER605W v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.0.4 Build 20260723 Rel.43763",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cp\u003eA vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can\u0026nbsp;observe\u0026nbsp;or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path.\u0026nbsp;\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eSuccessful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment.\u003c/p\u003e\u003c/div\u003e"
}
],
"value": "A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can\u00a0observe\u00a0or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path.\u00a0\n\n\n\n\n\nSuccessful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment."
}
],
"impacts": [
{
"capecId": "CAPEC-158",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-158 Sniffing Network Traffic"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "CWE-319 Cleartext transmission of sensitive information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:32:27.650Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"name": "Omada Gateway Firmware Downloads (EN)",
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/en/support/download/"
},
{
"name": "Omada Gateway Firmware Downloads (US)",
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/us/support/download/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5256/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-19683",
"datePublished": "2026-08-20T18:32:27.650Z",
"dateReserved": "2026-08-12T23:34:21.158Z",
"dateUpdated": "2026-08-20T18:58:42.948Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19586 (GCVE-0-2026-19586)
Vulnerability from cvelistv5 – Published: 2026-08-20 18:32 – Updated: 2026-08-21 03:56
VLAI
EPSS
VEX
Title
Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways
Summary
A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.
Successful exploitation may allow arbitrary command execution, potentially
leading to full compromise of the affected device.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.omadanetworks.com/en/support/download/ | patch |
| https://www.omadanetworks.com/us/support/download/ | patch |
| https://www.tp-link.com/us/support/faq/5256/ | vendor-advisory |
Impacted products
19 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | ER7212PC v2 |
Affected:
0 , < 2.4.3 Build 20260722 Rel.40250
(custom)
|
|
| TP-Link Systems Inc. | ER605 v2 |
Affected:
0 , < 2.4.4 Build 20260630 Rel.14398
(custom)
|
|
| TP-Link Systems Inc. | ER7206 v2 |
Affected:
0 , < 2.3.5 Build 20260625 Rel.43136
(custom)
|
|
| TP-Link Systems Inc | ER7406 v1 |
Affected:
0 , < 1.3.4 Build 20260625 Rel.43136
(custom)
|
|
| TP-Link Systems Inc. | ER707-M2 v1 |
Affected:
0 , < 1.4.4 Build 20260625 Rel.43063
(custom)
|
|
| TP-Link Systems Inc | ER7412-M2 v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.82947
(custom)
|
|
| TP-Link Systems Inc. | ER8411 v1 |
Affected:
0 , < 1.4.1 Build 20260708 Rel.64832
(custom)
|
|
| TP-Link Systems Inc. | ER706W v1 |
Affected:
0 , < 1.2.11 Build 20260723 Rel.41567
(custom)
|
|
| TP-Link Systems Inc. | v1 |
Affected:
0 , < 1.2.6 Build 20260723 Rel.41321
(custom)
|
|
| TP-Link Systems Inc. | ER706W-4G v2 |
Affected:
0 , < 2.1.11 Build 20260723 Rel.41624
(custom)
|
|
| TP-Link Systems Inc. | ER706WP-4G v1 |
Affected:
0 , < 1.1.11 Build 20260723 Rel.41624
(custom)
|
|
| TP-Link Systems Inc. | ER703WP-4G-Outdoor v1 |
Affected:
0 , < 1.1.7 Build 20260723 Rel.41712
(custom)
|
|
| TP-Link Systems Inc. | DR3220v-4G v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.82652
(custom)
|
|
| TP-Link Systems Inc. | DR3650v v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.83311
(custom)
|
|
| TP-Link Systems Inc. | DR3650v-4G v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.83347
(custom)
|
|
| TP-Link Systems Inc. | ER603WP-4G-Outdoor v1 |
Affected:
0 , < 1.0.2 Build 20260723 Rel.43271
(custom)
|
|
| TP-Link Systems Inc. | DR3150 v1 |
Affected:
0 , < 1.0.1 Build 20260722 Rel.16854
(custom)
|
|
| TP-Link Systems Inc. | ER701-5G-Outdoor v1 |
Affected:
0 , < 1.0.3 Build 20260723 Rel.40931
(custom)
|
|
| TP-Link Systems Inc. | ER605W v2 |
Affected:
0 , < 2.0.4 Build 20260723 Rel.43763
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19586",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T03:56:42.164Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ER7212PC v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.4.3 Build 20260722 Rel.40250",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER605 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.4.4 Build 20260630 Rel.14398",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7206 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.3.5 Build 20260625 Rel.43136",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7406 v1",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"lessThan": "1.3.4 Build 20260625 Rel.43136",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER707-M2 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.4 Build 20260625 Rel.43063",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7412-M2 v1",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.82947",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER8411 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.1 Build 20260708 Rel.64832",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706W v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.11 Build 20260723 Rel.41567",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.6 Build 20260723 Rel.41321",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706W-4G v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.1.11 Build 20260723 Rel.41624",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706WP-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.11 Build 20260723 Rel.41624",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER703WP-4G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.7 Build 20260723 Rel.41712",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3220v-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.82652",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3650v v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.83311",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3650v-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.83347",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER603WP-4G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.2 Build 20260723 Rel.43271",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3150 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.1 Build 20260722 Rel.16854",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER701-5G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.3 Build 20260723 Rel.40931",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER605W v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.0.4 Build 20260723 Rel.43763",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matt Graham (mattg.systems)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.\u0026nbsp;\u003c/p\u003e\u003cp\u003eSuccessful exploitation may allow arbitrary command execution,\u0026nbsp;\u003cspan\u003epotentially\nleading to full compromise of the affected device.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.\u00a0\n\n\n\nSuccessful exploitation may allow arbitrary command execution,\u00a0potentially\nleading to full compromise of the affected device."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:32:06.942Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"name": "Omada Gateway Firmware Downloads (EN)",
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/en/support/download/"
},
{
"name": "Omada Gateway Firmware Downloads (US)",
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/us/support/download/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5256/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-19586",
"datePublished": "2026-08-20T18:32:06.942Z",
"dateReserved": "2026-08-12T00:06:23.069Z",
"dateUpdated": "2026-08-21T03:56:42.164Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9033 (GCVE-0-2026-9033)
Vulnerability from cvelistv5 – Published: 2026-08-20 18:31 – Updated: 2026-08-20 18:59
VLAI
EPSS
VEX
Title
Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways
Summary
An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.
Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 18:59 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.omadanetworks.com/en/support/download/ | patch |
| https://www.omadanetworks.com/us/support/download/ | patch |
| https://www.tp-link.com/us/support/faq/5256/ | vendor-advisory |
Impacted products
19 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | ER7212PC v2 |
Affected:
0 , < 2.4.3 Build 20260722 Rel.40250
(custom)
|
|
| TP-Link Systems Inc. | ER605 v2 |
Affected:
0 , < 2.4.4 Build 20260630 Rel.14398
(custom)
|
|
| TP-Link Systems Inc. | ER7206 v2 |
Affected:
0 , < 2.3.5 Build 20260625 Rel.43136
(custom)
|
|
| TP-Link Systems Inc | ER7406 v1 |
Affected:
0 , < 1.3.4 Build 20260625 Rel.43136
(custom)
|
|
| TP-Link Systems Inc. | ER707-M2 v1 |
Affected:
0 , < 1.4.4 Build 20260625 Rel.43063
(custom)
|
|
| TP-Link Systems Inc | ER7412-M2 v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.82947
(custom)
|
|
| TP-Link Systems Inc. | ER8411 v1 |
Affected:
0 , < 1.4.1 Build 20260708 Rel.64832
(custom)
|
|
| TP-Link Systems Inc. | ER706W v1 |
Affected:
0 , < 1.2.11 Build 20260723 Rel.41567
(custom)
|
|
| TP-Link Systems Inc. | ER706W-4G v1 |
Affected:
0 , < 1.2.6 Build 20260723 Rel.41321
(custom)
|
|
| TP-Link Systems Inc. | ER706W-4G v2 |
Affected:
0 , < 2.1.11 Build 20260723 Rel.41624
(custom)
|
|
| TP-Link Systems Inc. | ER706WP-4G v1 |
Affected:
0 , < 1.1.11 Build 20260723 Rel.41624
(custom)
|
|
| TP-Link Systems Inc. | ER703WP-4G-Outdoor v1 |
Affected:
0 , < 1.1.7 Build 20260723 Rel.41712
(custom)
|
|
| TP-Link Systems Inc. | DR3220v-4G v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.82652
(custom)
|
|
| TP-Link Systems Inc. | DR3650v v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.83311
(custom)
|
|
| TP-Link Systems Inc. | DR3650v-4G v1 |
Affected:
0 , < 1.2.0 Build 20260630 Rel.83347
(custom)
|
|
| TP-Link Systems Inc. | ER603WP-4G-Outdoor v1 |
Affected:
0 , < 1.0.2 Build 20260723 Rel.43271
(custom)
|
|
| TP-Link Systems Inc. | DR3150 v1 |
Affected:
0 , < 1.0.1 Build 20260722 Rel.16854
(custom)
|
|
| TP-Link Systems Inc. | ER701-5G-Outdoor v1 |
Affected:
0 , < 1.0.3 Build 20260723 Rel.40931
(custom)
|
|
| TP-Link Systems Inc. | ER605W v2 |
Affected:
0 , < 2.0.4 Build 20260723 Rel.43763
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9033",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T18:59:29.032581Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:59:36.657Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ER7212PC v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.4.3 Build 20260722 Rel.40250",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER605 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.4.4 Build 20260630 Rel.14398",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7206 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.3.5 Build 20260625 Rel.43136",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7406 v1",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"lessThan": "1.3.4 Build 20260625 Rel.43136",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER707-M2 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.4 Build 20260625 Rel.43063",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER7412-M2 v1",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.82947",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER8411 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.1 Build 20260708 Rel.64832",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706W v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.11 Build 20260723 Rel.41567",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706W-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.6 Build 20260723 Rel.41321",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706W-4G v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.1.11 Build 20260723 Rel.41624",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER706WP-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.11 Build 20260723 Rel.41624",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER703WP-4G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.7 Build 20260723 Rel.41712",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3220v-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.82652",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3650v v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.83311",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3650v-4G v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 Build 20260630 Rel.83347",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER603WP-4G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.2 Build 20260723 Rel.43271",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DR3150 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.1 Build 20260722 Rel.16854",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER701-5G-Outdoor v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.0.3 Build 20260723 Rel.40931",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ER605W v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "2.0.4 Build 20260723 Rel.43763",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yoontae Lee (@yunttai)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.\u0026nbsp;\u003c/p\u003e\u003cp\u003eSuccessful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.\u003c/p\u003e"
}
],
"value": "An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.\u00a0\n\n\n\nSuccessful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:31:54.806Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"name": "Omada Gateway Firmware Downloads (EN)",
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/en/support/download/"
},
{
"name": "Omada Gateway Firmware Downloads (US)",
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/us/support/download/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5256/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-9033",
"datePublished": "2026-08-20T18:31:54.806Z",
"dateReserved": "2026-05-19T16:30:37.346Z",
"dateUpdated": "2026-08-20T18:59:36.657Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8619 (GCVE-0-2026-8619)
Vulnerability from cvelistv5 – Published: 2026-08-19 23:11 – Updated: 2026-08-20 16:27
VLAI
EPSS
VEX
Title
Unauthenticated Denial-of-Service Vulnerability in HTTP Service in TP-Link TL-MR100, TL-MR150, TL-MR6400 and Archer MR600
Summary
An
unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions
that may lead to a NULL pointer dereference.
A remote attacker on an adjacent network can send a specially crated
HTTP request to trigger a crash of the HTTP service process.
Successful
exploitation may cause the HTTP service to crash, making the web management
interface and HTTP-dependent functionality temporarily unavailable.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 16:03 UTC
CWE
- CWE-476 - NULL pointer dereference
Assigner
References
5 references
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | TL-MR100 v3.2 |
Affected:
0 , < TL-MR100(EU)_V3.20_1.3.0 Build 260609 Rel.49957n
(custom)
|
|
| TP-Link Systems Inc. | TL-MR150 v.3.2 |
Affected:
0 , < TL-MR150(EU)_V3.20_1.3.0 Build 260720 Rel.59727n
(custom)
|
|
| TP-Link Systems Inc. | TL-MR6400 v8.0 |
Affected:
0 , < TL-MR6400(EN)_V8_1.5.0 Build 260610 Rel.67978n
(custom)
|
|
| TP-Link Systems Inc | Archer MR600 v2 |
Affected:
0 , < Archer MR600(EU)_V2_1.10.0 Build 260618
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8619",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T16:03:32.689670Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T16:27:30.130Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "TL-MR100 v3.2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "TL-MR100(EU)_V3.20_1.3.0 Build 260609 Rel.49957n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "TL-MR150 v.3.2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "TL-MR150(EU)_V3.20_1.3.0 Build 260720 Rel.59727n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "TL-MR6400 v8.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "TL-MR6400(EN)_V8_1.5.0 Build 260610 Rel.67978n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Archer MR600 v2",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"lessThan": "Archer MR600(EU)_V2_1.10.0 Build 260618",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "haehet"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn\nunauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions\nthat may lead to a NULL pointer dereference.\u0026nbsp;\nA remote attacker on an adjacent network can send a specially crated\nHTTP request to trigger a crash of the HTTP service process.\u003c/p\u003e\n\n\u003cp\u003eSuccessful\nexploitation may cause the HTTP service to crash, making the web management\ninterface and HTTP-dependent functionality temporarily unavailable.\u0026nbsp;\u0026nbsp;\u003c/p\u003e"
}
],
"value": "An\nunauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions\nthat may lead to a NULL pointer dereference.\u00a0\nA remote attacker on an adjacent network can send a specially crated\nHTTP request to trigger a crash of the HTTP service process.\n\n\n\n\n\nSuccessful\nexploitation may cause the HTTP service to crash, making the web management\ninterface and HTTP-dependent functionality temporarily unavailable."
}
],
"impacts": [
{
"capecId": "CAPEC-125",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-125 Flooding"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL pointer dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T23:11:51.163Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/tl-mr100/v3.20/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/tl-mr150/v3.20/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmware"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5253/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Denial-of-Service Vulnerability in HTTP Service in TP-Link TL-MR100, TL-MR150, TL-MR6400 and Archer MR600",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-8619",
"datePublished": "2026-08-19T23:11:51.163Z",
"dateReserved": "2026-05-14T18:04:19.124Z",
"dateUpdated": "2026-08-20T16:27:30.130Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75616 (GCVE-0-2026-75616)
Vulnerability from cvelistv5 – Published: 2026-08-19 20:44 – Updated: 2026-08-20 15:26
VLAI
EPSS
VEX
Title
Command Injection in Router Web Management Interface
Summary
An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting in full device compromise.
Successful exploitation may allow arbitrary command execution with elevated privileges, compromising the confidentiality, integrity, and availability of the affected device and network traffic passing through it.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 15:15 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.tp-link.com/us/support/download/arche… | patch |
| https://www.tp-link.com/en/support/download/arche… | patch |
| https://www.tp-link.com/en/support/faq/5252/ | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | Archer C20 v6 |
Affected:
0 , < EU_0.9.1 Build 260811
(custom)
Affected: 0 , < US_0.9.1 Build 260812 (custom) Affected: 0 , < RU_0.9.1 Build 260812 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75616",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T15:15:42.024258Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T15:26:33.291Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Archer C20 v6",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "EU_0.9.1 Build 260811",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "US_0.9.1 Build 260812",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "RU_0.9.1 Build 260812",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniil Gordeev (totekuh)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eAn OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting in full device compromise.\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003eSuccessful exploitation may allow arbitrary command execution with elevated privileges, compromising the confidentiality, integrity, and availability of the affected device\u0026nbsp;\u003cspan\u003eand network traffic passing through it.\u003c/span\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting in full device compromise.\n\n\n\n\n\n\nSuccessful exploitation may allow arbitrary command execution with elevated privileges, compromising the confidentiality, integrity, and availability of the affected device\u00a0and network traffic passing through it."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T20:44:11.468Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/archer-c20/v6.46/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/en/support/faq/5252/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Command Injection in Router Web Management Interface",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-75616",
"datePublished": "2026-08-19T20:44:11.468Z",
"dateReserved": "2026-08-17T23:56:24.056Z",
"dateUpdated": "2026-08-20T15:26:33.291Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75619 (GCVE-0-2026-75619)
Vulnerability from cvelistv5 – Published: 2026-08-19 18:30 – Updated: 2026-08-27 23:12
VLAI
EPSS
VEX
Title
RTSP Heap Buffer Overflow Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101
Summary
Tapo
C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP
service. An authenticated attacker on the local network can send specially
crafted RTSP frame data containing oversized length values, resulting in
out-of-bounds heap writes.
Successful
exploitation can crash the RTSP service and trigger a device reboot, resulting
in a temporary denial-of-service condition.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 19:31 UTC
CWE
- CWE-122 - Heap-based buffer overflow
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | Tapo C100 v5 |
Affected:
0 , < 1.5.4 Build 260528 Rel.11462n
(custom)
|
|
| TP-Link Systems Inc. | Tapo C101 v5 |
Affected:
0 , < 1.5.4 Build 260528 Rel.11462n
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75619",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T19:31:18.255651Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T19:31:44.015Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Tapo C100 v5",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.5.4 Build 260528 Rel.11462n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tapo C101 v5",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.5.4 Build 260528 Rel.11462n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Cooper Young (https://coopergyoung.com)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTapo\nC100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP\nservice. An authenticated attacker on the local network can send specially\ncrafted RTSP frame data containing oversized length values, resulting in\nout-of-bounds heap writes. \u003c/p\u003e\n\n\u003cp\u003eSuccessful\nexploitation can crash the RTSP service and trigger a device reboot, resulting\nin a temporary denial-of-service condition.\u003c/p\u003e"
}
],
"value": "Tapo\nC100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP\nservice. An authenticated attacker on the local network can send specially\ncrafted RTSP frame data containing oversized length values, resulting in\nout-of-bounds heap writes. \n\n\n\n\n\nSuccessful\nexploitation can crash the RTSP service and trigger a device reboot, resulting\nin a temporary denial-of-service condition."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T23:12:28.065Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/tapo-c100/#Firmware-Release-Notes"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/tapo-c101/#Firmware-Release-Notes"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5251/"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/tapo-c100/#Firmware-Release-Notes"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "RTSP Heap Buffer Overflow Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-75619",
"datePublished": "2026-08-19T18:30:59.192Z",
"dateReserved": "2026-08-18T00:01:50.160Z",
"dateUpdated": "2026-08-27T23:12:28.065Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75618 (GCVE-0-2026-75618)
Vulnerability from cvelistv5 – Published: 2026-08-19 18:30 – Updated: 2026-08-27 23:12
VLAI
EPSS
VEX
Title
RTSP Null Pointer Dereference Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101
Summary
Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and device reboot. Successful exploitation can disrupt live video streaming functionality and cause a temporary denial-of-service condition.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 19:32 UTC
CWE
- CWE-476 - NULL pointer dereference
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | Tapo C100 v5 |
Affected:
0 , < 1.5.4 Build 260528 Rel.11462n
(custom)
|
|
| TP-Link Systems Inc. | Tapo C101 v5 |
Affected:
0 , < 1.5.4 Build 260528 Rel.11462n
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75618",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T19:32:28.523402Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T19:33:00.398Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Tapo C100 v5",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.5.4 Build 260528 Rel.11462n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tapo C101 v5",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.5.4 Build 260528 Rel.11462n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Cooper Young (https://coopergyoung.com)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eTapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and device reboot. Successful exploitation can disrupt live video streaming functionality and cause a temporary denial-of-service condition.\u003c/div\u003e"
}
],
"value": "Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and device reboot. Successful exploitation can disrupt live video streaming functionality and cause a temporary denial-of-service condition."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL pointer dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T23:12:07.933Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/tapo-c100/#Firmware-Release-Notes"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/tapo-c101/#Firmware-Release-Notes"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/tapo-c100/#Firmware-Release-Notes"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5251/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "RTSP Null Pointer Dereference Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-75618",
"datePublished": "2026-08-19T18:30:50.089Z",
"dateReserved": "2026-08-18T00:01:49.092Z",
"dateUpdated": "2026-08-27T23:12:07.933Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15316 (GCVE-0-2026-15316)
Vulnerability from cvelistv5 – Published: 2026-08-18 21:25 – Updated: 2026-08-20 15:36
VLAI
EPSS
VEX
Title
Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200
Summary
An improper input
validation vulnerability in the configuration service for processing encrypted
credential data has been identified in Tapo C200 v5. An attacker can send oversized crypted
ciphertext values that may trigger exception handling failures, due to insufficient
validation, causing the affected device to crash or restart.
Successful
exploitation may temporarily disrupt HTTPS management and monitoring
functionality, resulting in a denial-of-service (DoS) condition until the
service recovers.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 13:31 UTC
CWE
- CWE-20 - Improper input validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.tp-link.com/us/support/download/tapo-… | patch |
| https://www.tp-link.com/en/support/download/tapo-… | patch |
| https://www.tp-link.com/us/support/faq/5248/ | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | Tapo C200 v5 |
Affected:
0 , < V5_1.4.6 Build 260709 Rel.27675n
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15316",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T13:31:45.040163Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T15:36:48.337Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Tapo C200 v5",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V5_1.4.6 Build 260709 Rel.27675n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Thai Do (Lio) and Khoi Tran (KayTii) from OPSWAT"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eAn improper input\nvalidation vulnerability in the configuration service for processing encrypted\ncredential data has been identified in Tapo C200 v5.\u003c/span\u003e\u003cspan\u003e\u0026nbsp; \u003c/span\u003e\u003cspan\u003eAn attacker can send oversized crypted\nciphertext values that may trigger exception handling failures, due to insufficient\nvalidation, causing the affected device to crash or restart.\u003c/span\u003e\u003c/p\u003e\n\n\u003cp\u003eSuccessful\nexploitation may temporarily disrupt HTTPS management and monitoring\nfunctionality, resulting in a denial-of-service (DoS) condition until the\nservice recovers.\u003c/p\u003e"
}
],
"value": "An improper input\nvalidation vulnerability in the configuration service for processing encrypted\ncredential data has been identified in Tapo C200 v5.\u00a0 An attacker can send oversized crypted\nciphertext values that may trigger exception handling failures, due to insufficient\nvalidation, causing the affected device to crash or restart.\n\n\n\n\n\nSuccessful\nexploitation may temporarily disrupt HTTPS management and monitoring\nfunctionality, resulting in a denial-of-service (DoS) condition until the\nservice recovers."
}
],
"impacts": [
{
"capecId": "CAPEC-24",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-24 Filter Failure through Buffer Overflow"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T21:25:11.118Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/tapo-c200/v5/"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/tapo-c200/v5/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5248/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-15316",
"datePublished": "2026-08-18T21:25:11.118Z",
"dateReserved": "2026-07-09T17:55:11.713Z",
"dateUpdated": "2026-08-20T15:36:48.337Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15315 (GCVE-0-2026-15315)
Vulnerability from cvelistv5 – Published: 2026-08-18 21:24 – Updated: 2026-08-27 23:08
VLAI
EPSS
VEX
Title
Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200
Summary
Tapo C120 v1 and C200 v5
contain an improper authentication vulnerability within the login
authentication verification module. An attacker on the local network can
exploit weaknesses in challenge parameter validation to bypass normal
authentication controls and obtain administrative session tokens.
Successful
exploitation may allow an attacker to subsequently execute privileged
management actions, enable unauthorized administrative access and temporary
disruption of device services, resulting in a denial-of-service (DoS)
condition.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 13:31 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
5 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | Tapo C200 v5 |
Affected:
0 , < V5_1.4.6 Build 260709 Rel.27675n
(custom)
|
|
| TP-Link Systems Inc | Tapo C120 v1 |
Affected:
0 , < 1.9.3 Build 260521
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15315",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T13:31:33.290986Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T15:36:48.560Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Tapo C200 v5",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V5_1.4.6 Build 260709 Rel.27675n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tapo C120 v1",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"lessThan": "1.9.3 Build 260521",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Thai Do (Lio) and Khoi Tran (KayTii) from OPSWAT"
},
{
"lang": "en",
"type": "finder",
"value": "Max Aitel"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTapo C120 v1 and C200 v5\ncontain an improper authentication vulnerability within the login\nauthentication verification module. An attacker on the local network can\nexploit weaknesses in challenge parameter validation to bypass normal\nauthentication controls and obtain administrative session tokens. \u003c/p\u003e\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eSuccessful\nexploitation may allow an attacker to subsequently execute privileged\nmanagement actions, enable unauthorized administrative access and temporary\ndisruption of device services, resulting in a denial-of-service (DoS)\ncondition.\u003c/p\u003e"
}
],
"value": "Tapo C120 v1 and C200 v5\ncontain an improper authentication vulnerability within the login\nauthentication verification module. An attacker on the local network can\nexploit weaknesses in challenge parameter validation to bypass normal\nauthentication controls and obtain administrative session tokens. \n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow an attacker to subsequently execute privileged\nmanagement actions, enable unauthorized administrative access and temporary\ndisruption of device services, resulting in a denial-of-service (DoS)\ncondition."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T23:08:42.298Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/tapo-c200/v5/"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/tapo-c200/v5/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5248/"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/tapo-c120/v1.26/#Firmware-Release-Notes"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/tapo-c120/v1.26/#Firmware-Release-Notes"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-15315",
"datePublished": "2026-08-18T21:24:59.428Z",
"dateReserved": "2026-07-09T17:55:09.825Z",
"dateUpdated": "2026-08-27T23:08:42.298Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15141 (GCVE-0-2026-15141)
Vulnerability from cvelistv5 – Published: 2026-08-12 22:35 – Updated: 2026-08-13 13:11
VLAI
EPSS
VEX
Title
Referer Validation Bypass in TL-WR820N Web Management Interface
Summary
The web
interface of the affected
device relies on the HTTP referrer header as part of
request validation. Requests containing empty Referer value, or omitting
the Referer header entirely, may be accepted and processed due to insufficient
validation logic.
Successful exploitation may allow an adjacent attacker with access to the web management
interface to obtain device configuration details and other sensitive
information.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 13:11 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.tp-link.com/kr/support/download/tl-wr… | patch |
| https://www.tp-link.com/en/support/download/tl-wr… | patch |
| https://www.tp-link.com/en/support/faq/5243/ | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | TL-WR820N v2 |
Affected:
0 , < 1.15.20 Build 260611 Rel.29552n
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15141",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T13:11:43.168498Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:11:50.851Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TL-WR820N v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.15.20 Build 260611 Rel.29552n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Seong Hun Jeong (HunSec)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe web\ninterface of the affected\ndevice relies on the HTTP referrer header as part of\nrequest validation.\u0026nbsp; Requests\u0026nbsp;containing empty Referer value, or omitting\nthe Referer header entirely, may be accepted and processed due to insufficient\nvalidation logic.\u003c/p\u003e\n\n\u003cp\u003eSuccessful exploitation may allow an adjacent attacker with access to the web management\ninterface to obtain device configuration details and other sensitive\ninformation.\u003c/p\u003e"
}
],
"value": "The web\ninterface of the affected\ndevice relies on the HTTP referrer header as part of\nrequest validation.\u00a0 Requests\u00a0containing empty Referer value, or omitting\nthe Referer header entirely, may be accepted and processed due to insufficient\nvalidation logic.\n\n\n\n\n\nSuccessful exploitation may allow an adjacent attacker with access to the web management\ninterface to obtain device configuration details and other sensitive\ninformation."
}
],
"impacts": [
{
"capecId": "CAPEC-104",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-104 Cross Zone Scripting"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346 Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T22:35:58.962Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/kr/support/download/tl-wr820n/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/tl-wr820n/#Firmware"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/en/support/faq/5243/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Referer Validation Bypass in TL-WR820N Web Management Interface",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-15141",
"datePublished": "2026-08-12T22:35:58.962Z",
"dateReserved": "2026-07-08T17:23:13.249Z",
"dateUpdated": "2026-08-13T13:11:50.851Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-30241 (GCVE-0-2025-30241)
Vulnerability from cvelistv5 – Published: 2026-08-10 22:26 – Updated: 2026-08-12 18:56
VLAI
EPSS
VEX
Title
OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices
Summary
Certain web
interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before
passing it to system-level command execution functions. An authenticated adjacent attacker may inject
specially crafted input to execute arbitrary operation system commands with
elevated privileges.
Successful
exploitation may allow execution of arbitrary system commands, potentially
leading to full device compromise.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 18:55 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.tp-link.com/us/support/faq/5239/ | vendor-advisory |
Impacted products
31 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | HB810(US2) V1.0/1.6/2.0/2.6 |
Affected:
0 , < 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n
(custom)
|
|
| TP-Link Systems Inc. | HB810(EU1) V2.0 |
Affected:
0 , < 0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567n
(custom)
|
|
| TP-Link Systems Inc. | HB710(US2) V1.6/1.0 |
Affected:
0 , < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n
(custom)
|
|
| TP-Link Systems Inc. | HB710(EU1) 1.0 |
Affected:
0 , < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n
(custom)
|
|
| TP-Link Systems Inc. | HB610(US2) V2.6/2.0 |
Affected:
0 , < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n
(custom)
|
|
| TP-Link Systems Inc. | HB610(EU1) |
Affected:
0 , < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n
(custom)
|
|
| TP-Link Systems Inc. | HB610(CA) V2.0 |
Affected:
0 , < 0.6.0 3.0.0 v60af.0 Build 251216 Rel.46954n
(custom)
|
|
| TP-Link Systems Inc. | HB410( EU1) 1.0 |
Affected:
0 , < 0.3.0 3.0.0 v60bf.0 Build 250901 Rel.45574n
(custom)
|
|
| TP-Link Systems Inc. | HB210(US2) 1.0 |
Affected:
0 , < 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n
(custom)
|
|
| TP-Link Systems Inc. | HB210(EU1) 1.0 |
Affected:
0 , < 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n
(custom)
|
|
| TP-Link Systems Inc. | HB210 Pro(EU1)1.0 |
Affected:
0 , < 0.5.0 3.0.0 v60d5.0 Build 250922 Rel.13742n
(custom)
|
|
| TP-Link Systems Inc. | HB210 Pro(US2)1.0/1.6 |
Affected:
0 , < 0.8.0 3.0.0 v60d5.0 Build 260318 Rel.78363n
(custom)
|
|
| TP-Link Systems Inc. | EB210 Pro(EU1) 1.0 |
Affected:
0 , < 0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n
(custom)
|
|
| TP-Link Systems Inc. | EB210 Pro(US1) 1.0 |
Affected:
0 , < 0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n
(custom)
|
|
| TP-Link Systems Inc. | EB810v(EU1) V1.0 |
Affected:
0 , < 0.6.0 3.0.0 v608b.0 Build 250613 Rel.10497n
(custom)
|
|
| TP-Link Systems Inc. | EX220(BR) V1.0/1.20/1.28/1.29/1.8 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX220(BR) V2.0 |
Affected:
0 , < 0.19.0 2.0.0 v609b.0 Build 250814 Rel.49732n
(custom)
|
|
| TP-Link Systems Inc. | EX220(EU1) V1.0/1.20 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX220(RU) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX220(US1) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX222(EU1) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX222(KR) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v609b.0 Build 260427 Rel.16915
(custom)
|
|
| TP-Link Systems Inc. | EX222(US1) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX520v(EU1)1.0 |
Affected:
0 , < 0.1.0 3.0.0 v60ee.0 Build 250310 Rel.55637n
(custom)
|
|
| TP-Link Systems Inc. | EX820v(EU1) V1.0 |
Affected:
0 , < 0.4.0 3.1.9 v6087.0 Build 250928 Rel.59674n
(custom)
|
|
| TP-Link Systems Inc. | EX920(US2) V1.6/V1.0 |
Affected:
0 , < 0.8.0 3.2.2 v6080.0 Build 260309 Rel.54790n
(custom)
|
|
| TP-Link Systems Inc. | XX530v(BR)v2.0 |
Affected:
0 , < 0.4.0 3.1.10 v60dc.0 Build 250520 Rel.69748n
(custom)
|
|
| TP-Link Systems Inc. | XX530v(EU1) |
Affected:
0 , < 0.3.0 3.1.10 v6107.0 Build 250425 Rel.71973n
(custom)
|
|
| TP-Link Systems Inc. | XX230v(BR) V1.0 |
Affected:
0 , < 0.16.0 3.0.0 v6066.0 Build 250423 Rel.43799n
(custom)
|
|
| TP-Link Systems Inc. | VX800v(DE) V1.0 |
Affected:
0 , < 800.0.16
(custom)
|
|
| TP-Link Systems Inc. | VX420-G2h(AU) V3.0 |
Affected:
0 , < 0.2.0 2.0.0 v60df.0 Build 250427 Rel.38233n
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-30241",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:55:44.663742Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:56:29.140Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HB810(US2) V1.0/1.6/2.0/2.6",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB810(EU1) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB710(US2) V1.6/1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB710(EU1) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB610(US2) V2.6/2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB610(EU1)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB610(CA) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v60af.0 Build 251216 Rel.46954n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB410( EU1) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.0.0 v60bf.0 Build 250901 Rel.45574n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB210(US2) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB210(EU1) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB210 Pro(EU1)1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.5.0 3.0.0 v60d5.0 Build 250922 Rel.13742n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB210 Pro(US2)1.0/1.6",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.8.0 3.0.0 v60d5.0 Build 260318 Rel.78363n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EB210 Pro(EU1) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EB210 Pro(US1) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EB810v(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v608b.0 Build 250613 Rel.10497n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(BR) V1.0/1.20/1.28/1.29/1.8",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(BR) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.19.0 2.0.0 v609b.0 Build 250814 Rel.49732n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(EU1) V1.0/1.20",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(RU) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(US1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX222(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX222(KR) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v609b.0 Build 260427 Rel.16915",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX222(US1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX520v(EU1)1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.1.0 3.0.0 v60ee.0 Build 250310 Rel.55637n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX820v(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.4.0 3.1.9 v6087.0 Build 250928 Rel.59674n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX920(US2) V1.6/V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.8.0 3.2.2 v6080.0 Build 260309 Rel.54790n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX530v(BR)v2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.4.0 3.1.10 v60dc.0 Build 250520 Rel.69748n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX530v(EU1)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.1.10 v6107.0 Build 250425 Rel.71973n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX230v(BR) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.16.0 3.0.0 v6066.0 Build 250423 Rel.43799n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VX800v(DE) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "800.0.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VX420-G2h(AU) V3.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.2.0 2.0.0 v60df.0 Build 250427 Rel.38233n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Gerhard Hechenberger, Stefan Schweighofer, Constantin Schieber-Knoebl from the SEC Consult Vulnerability Lab"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCertain web\ninterface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before\npassing it to system-level command execution functions.\u0026nbsp; An authenticated adjacent attacker may inject\nspecially crafted input to execute arbitrary operation system commands with\nelevated privileges.\u003c/p\u003e\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eSuccessful\nexploitation may allow execution of arbitrary system commands, potentially\nleading to full device compromise.\u003c/p\u003e"
}
],
"value": "Certain web\ninterface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before\npassing it to system-level command execution functions.\u00a0 An authenticated adjacent attacker may inject\nspecially crafted input to execute arbitrary operation system commands with\nelevated privileges.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow execution of arbitrary system commands, potentially\nleading to full device compromise."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88: OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T22:26:08.525Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"name": "TP-Link Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5239/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2025-30241",
"datePublished": "2026-08-10T22:26:08.525Z",
"dateReserved": "2025-03-19T11:09:33.245Z",
"dateUpdated": "2026-08-12T18:56:29.140Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-30240 (GCVE-0-2025-30240)
Vulnerability from cvelistv5 – Published: 2026-08-10 22:25 – Updated: 2026-08-12 18:18
VLAI
EPSS
VEX
Title
Arbitrary File Read via Improper Symlink Handling in USB HTTPS Access Path in multiple TP-Link Aginet Devices
Summary
The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage
devices. By placing a crafted symbolic link on supported storage media, an
attacker may cause the system to resolve the link.
Successful
exploitation may allow unauthorized read access to sensitive files within the
device filesystem.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 18:18 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.tp-link.com/us/support/faq/5239/ | vendor-advisory |
Impacted products
33 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | HB810(US2) V1.0/1.6/2.0/2.6 |
Affected:
0 , < 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n
(custom)
|
|
| TP-Link Systems Inc. | HB810(EU1) V2.0 |
Affected:
0 , < 0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567n
(custom)
|
|
| TP-Link Systems Inc. | HB710(US2) V1.6/1.0 |
Affected:
0 , < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n
(custom)
|
|
| TP-Link Systems Inc. | HB710(EU1) 1.0 |
Affected:
0 , < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n
(custom)
|
|
| TP-Link Systems Inc. | HB610(US2) V2.6/2.0 |
Affected:
0 , < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n
(custom)
|
|
| TP-Link Systems Inc. | HB610(EU1) |
Affected:
0 , < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n
(custom)
|
|
| TP-Link Systems Inc. | HB610(CA) V2.0 |
Affected:
0 , < 0.6.0 3.0.0 v60af.0 Build 251216 Rel.46954n
(custom)
|
|
| TP-Link Systems Inc. | HB410( EU1) 1.0 |
Affected:
0 , < 0.3.0 3.0.0 v60bf.0 Build 250901 Rel.45574n
(custom)
|
|
| TP-Link Systems Inc. | HB210(US2) 1.0 |
Affected:
0 , < 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n
(custom)
|
|
| TP-Link Systems Inc. | HB210(EU1) 1.0 |
Affected:
0 , < 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n
(custom)
|
|
| TP-Link Systems Inc. | HB210 Pro(EU1)1.0 |
Affected:
0 , < 0.5.0 3.0.0 v60d5.0 Build 250922 Rel.13742n
(custom)
|
|
| TP-Link Systems Inc. | HB210 Pro(US2)1.0/1.6 |
Affected:
0 , < 0.8.0 3.0.0 v60d5.0 Build 260318 Rel.78363n
(custom)
|
|
| TP-Link Systems Inc. | EB810v(EU1) V1.0 |
Affected:
0 , < 0.6.0 3.0.0 v608b.0 Build 250613 Rel.10497n
(custom)
|
|
| TP-Link Systems Inc. | EX220(BR) V1.0/1.20/1.28/1.29/1.8 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX220(BR) V2.0 |
Affected:
0 , < 0.19.0 2.0.0 v609b.0 Build 250814 Rel.49732n
(custom)
|
|
| TP-Link Systems Inc. | EX220(EU1) V1.0/1.20 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX220(RU) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX220(US1) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX222(EU1) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX222(KR) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v609b.0 Build 260427 Rel.16915
(custom)
|
|
| TP-Link Systems Inc. | EX222(US1) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX520v(EU1)1.0 |
Affected:
0 , < 0.1.0 3.0.0 v60ee.0 Build 250310 Rel.55637n
(custom)
|
|
| TP-Link Systems Inc. | EX820v(EU1) V1.0 |
Affected:
0 , < 0.4.0 3.1.9 v6087.0 Build 250928 Rel.59674n
(custom)
|
|
| TP-Link Systems Inc. | EX920(US2) V1.6/V1.0 |
Affected:
0 , < 0.8.0 3.2.2 v6080.0 Build 260309 Rel.54790n
(custom)
|
|
| TP-Link Systems Inc. | XC220-G3v(EU1) V2.30 |
Affected:
0 , < 1.16.0 0.8.0 v6062.0 Build 250817 Rel.23310n
(custom)
|
|
| TP-Link Systems Inc. | XC220-G3v(US1) V2.30 |
Affected:
0 , < 1.16.0 0.8.0 v6062.0 Build 250817 Rel.23310n
(custom)
|
|
| TP-Link Systems Inc. | XX530v(BR)v1.0 |
Affected:
0 , < 0.6.0 3.0.0 v6096.0 Build 250416 Rel.26048n
(custom)
|
|
| TP-Link Systems Inc. | XX530v(BR)v2.0 |
Affected:
0 , < 0.4.0 3.1.10 v60dc.0 Build 250520 Rel.69748n
(custom)
|
|
| TP-Link Systems Inc. | XX530v(US1) |
Affected:
0 , < 0.6.0 3.0.0 v6096.0 Build 250416 Rel.26048n
(custom)
|
|
| TP-Link Systems Inc. | XX530v(EU1) |
Affected:
0 , < 0.3.0 3.1.10 v6107.0 Build 250425 Rel.71973n
(custom)
|
|
| TP-Link Systems Inc. | VX800v(DE) V1.0 |
Affected:
0 , < 800.0.16
(custom)
|
|
| TP-Link Systems Inc. | VX1800v(EU1) V1.0 |
Affected:
0 , < 0.14.0 2.0.0 v6092.0 Build 250417 Rel.24761n
(custom)
|
|
| TP-Link Systems Inc. | VX420-G2h(AU) V3.0 |
Affected:
0 , < 0.2.0 2.0.0 v60df.0 Build 250427 Rel.38233n
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-30240",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:18:03.157977Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:18:18.691Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HB810(US2) V1.0/1.6/2.0/2.6",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB810(EU1) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB710(US2) V1.6/1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB710(EU1) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB610(US2) V2.6/2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB610(EU1)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB610(CA) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v60af.0 Build 251216 Rel.46954n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB410( EU1) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.0.0 v60bf.0 Build 250901 Rel.45574n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB210(US2) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB210(EU1) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB210 Pro(EU1)1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.5.0 3.0.0 v60d5.0 Build 250922 Rel.13742n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB210 Pro(US2)1.0/1.6",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.8.0 3.0.0 v60d5.0 Build 260318 Rel.78363n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EB810v(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v608b.0 Build 250613 Rel.10497n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(BR) V1.0/1.20/1.28/1.29/1.8",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(BR) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.19.0 2.0.0 v609b.0 Build 250814 Rel.49732n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(EU1) V1.0/1.20",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(RU) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(US1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX222(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX222(KR) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v609b.0 Build 260427 Rel.16915",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX222(US1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX520v(EU1)1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.1.0 3.0.0 v60ee.0 Build 250310 Rel.55637n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX820v(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.4.0 3.1.9 v6087.0 Build 250928 Rel.59674n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX920(US2) V1.6/V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.8.0 3.2.2 v6080.0 Build 260309 Rel.54790n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XC220-G3v(EU1) V2.30",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.16.0 0.8.0 v6062.0 Build 250817 Rel.23310n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XC220-G3v(US1) V2.30",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.16.0 0.8.0 v6062.0 Build 250817 Rel.23310n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX530v(BR)v1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v6096.0 Build 250416 Rel.26048n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX530v(BR)v2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.4.0 3.1.10 v60dc.0 Build 250520 Rel.69748n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX530v(US1)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v6096.0 Build 250416 Rel.26048n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX530v(EU1)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.1.10 v6107.0 Build 250425 Rel.71973n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VX800v(DE) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "800.0.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VX1800v(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.14.0 2.0.0 v6092.0 Build 250417 Rel.24761n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VX420-G2h(AU) V3.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.2.0 2.0.0 v60df.0 Build 250427 Rel.38233n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Gerhard Hechenberger, Stefan Schweighofer, Constantin Schieber-Knoebl from the SEC Consult Vulnerability Lab"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage\ndevices. By placing a crafted symbolic link on supported storage media, an\nattacker may cause the system to resolve the link.\u003c/p\u003e\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eSuccessful\nexploitation may allow unauthorized read access to sensitive files within the\ndevice filesystem.\u003c/p\u003e"
}
],
"value": "The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage\ndevices. By placing a crafted symbolic link on supported storage media, an\nattacker may cause the system to resolve the link.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow unauthorized read access to sensitive files within the\ndevice filesystem."
}
],
"impacts": [
{
"capecId": "CAPEC-132",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-132: Symlink Attack"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T22:25:41.776Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"name": "TP-Link Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5239/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Arbitrary File Read via Improper Symlink Handling in USB HTTPS Access Path in multiple TP-Link Aginet Devices",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2025-30240",
"datePublished": "2026-08-10T22:25:41.776Z",
"dateReserved": "2025-03-19T11:09:33.245Z",
"dateUpdated": "2026-08-12T18:18:18.691Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-30239 (GCVE-0-2025-30239)
Vulnerability from cvelistv5 – Published: 2026-08-10 22:25 – Updated: 2026-08-11 14:49
VLAI
EPSS
VEX
Title
Sensitive Data Exposure due to Hardcoded Cryptographic Keys in Multiple TP-Link Aginet Devices
Summary
In affected TP-Link Aginet devices, use of
hardcoded cryptographic keys embedded in the firmware to protect sensitive
configuration data may allow an attacker who has access to device storage to
recover the keys and decrypt stored data.
Successful
exploitation may allow access to decrypted sensitive configuration data,
including credentials and service-related information.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 14:49 UTC
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.tp-link.com/us/support/faq/5239/ | vendor-advisory |
Impacted products
65 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | HB810(US2) V1.0/1.6/2.0/2.6 |
Affected:
0 , < 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n
(custom)
|
|
| TP-Link Systems Inc. | HB810(EU1) V2.0 |
Affected:
0 , < 0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567n
(custom)
|
|
| TP-Link Systems Inc. | HB710(US2) V1.6/1.0 |
Affected:
0 , < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n
(custom)
|
|
| TP-Link Systems Inc. | HB710(EU1) 1.0 |
Affected:
0 , < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n
(custom)
|
|
| TP-Link Systems Inc. | HB610(US2) V2.6/2.0 |
Affected:
0 , < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n
(custom)
|
|
| TP-Link Systems Inc. | HB610(EU1) |
Affected:
0 , < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n
(custom)
|
|
| TP-Link Systems Inc. | HB610(CA) V2.0 |
Affected:
0 , < 0.6.0 3.0.0 v60af.0 Build 251216 Rel.46954n
(custom)
|
|
| TP-Link Systems Inc. | HB410( EU1) 1.0 |
Affected:
0 , < 0.3.0 3.0.0 v60bf.0 Build 250901 Rel.45574n
(custom)
|
|
| TP-Link Systems Inc. | HB210(US2) 1.0 |
Affected:
0 , < 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n
(custom)
|
|
| TP-Link Systems Inc. | HB210(EU1) 1.0 |
Affected:
0 , < 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n
(custom)
|
|
| TP-Link Systems Inc. | HB210 Pro(EU1)1.0 |
Affected:
0 , < 0.5.0 3.0.0 v60d5.0 Build 250922 Rel.13742n
(custom)
|
|
| TP-Link Systems Inc. | HB210 Pro(US2)1.0/1.6 |
Affected:
0 , < 0.8.0 3.0.0 v60d5.0 Build 260318 Rel.78363n
(custom)
|
|
| TP-Link Systems Inc. | HX510(US1) V2.0 |
Affected:
0 , < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n
(custom)
|
|
| TP-Link Systems Inc. | HX510(EU1) V2.0 |
Affected:
0 , < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n
(custom)
|
|
| TP-Link Systems Inc. | HX510(CA) V1.0/2.0 |
Affected:
0 , < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n
(custom)
|
|
| TP-Link Systems Inc. | HX510(AU) V1.0/2.0 |
Affected:
0 , < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n
(custom)
|
|
| TP-Link Systems Inc. | HX510(US2) 2.6 |
Affected:
0 , < 0.17.0 3.2.2 v6065.0 Build 260722 Rel.10662n
(custom)
|
|
| TP-Link Systems Inc. | HX710(EU1) V1.0 |
Affected:
0 , < 0.5.0 3.1.10 v6075.0 Build 260511 Rel.47847n
(custom)
|
|
| TP-Link Systems Inc. | HX710 Pro(EU1) V1.0 |
Affected:
0 , < 0.4.0 3.1.10 v6082.0 Build 260204 Rel.49460n
(custom)
|
|
| TP-Link Systems Inc. | HX220(US1) V1.0/1.0 |
Affected:
0 , < 0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n
(custom)
|
|
| TP-Link Systems Inc. | HX220(EU1) V1.0 |
Affected:
0 , < 0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n
(custom)
|
|
| TP-Link Systems Inc. | HX220(CA) V1.0 |
Affected:
0 , < 0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n
(custom)
|
|
| TP-Link Systems Inc. | HX220(AU) V1.0 |
Affected:
0 , < 0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n
(custom)
|
|
| TP-Link Systems Inc. | HX141(EU1) V1.0 |
Affected:
0 , < 1.2.0 3.1.0 v609d.0 Build 260128 Rel.29711n
(custom)
|
|
| TP-Link Systems Inc. | HC220-G5(US1) V1.0/1.6 |
Affected:
0 , < 0.18.0 2.0.0 v605e.0 Build 250827 Rel.37904n
(custom)
|
|
| TP-Link Systems Inc. | HC220-G5(EU1) V1.20/1.0 |
Affected:
0 , < 0.18.0 2.0.0 v605e.0 Build 250827 Rel.37904n
(custom)
|
|
| TP-Link Systems Inc. | HC220-G5(BR) V1.30 |
Affected:
0 , < 0.17.0 2.0.0 v605e.0 Build 250618 Rel.19329n
(custom)
|
|
| TP-Link Systems Inc. | EB210 Pro(EU1) 1.0 |
Affected:
0 , < 0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n
(custom)
|
|
| TP-Link Systems Inc. | EB210 Pro(US1) 1.0 |
Affected:
0 , < 0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n
(custom)
|
|
| TP-Link Systems Inc. | EB810v(EU1) V1.0 |
Affected:
0 , < 0.6.0 3.0.0 v608b.0 Build 250613 Rel.10497n
(custom)
|
|
| TP-Link Systems Inc. | EC220-G5(BR) V3.0 |
Affected:
0 , < 1.14.1 Build 250715 Rel.72650n(4252)
(custom)
|
|
| TP-Link Systems Inc. | EC220-G5(EU1) V3.0 |
Affected:
0 , < 1.15.1 Build 260205 Rel.38208n(4555)
(custom)
|
|
| TP-Link Systems Inc. | EC220-G5(US1) V3.0 |
Affected:
0 , < 1.14.1 Build 250715 Rel.72650n(4252)
(custom)
|
|
| TP-Link Systems Inc. | EC225-G5(BR) V1.0 |
Affected:
0 , < 1.14.1 Build 250717 Rel.34953n(4252)
(custom)
|
|
| TP-Link Systems Inc. | EC225-G5(EU1) V1.0 |
Affected:
0 , < 1.14.1 Build 250711 Rel.35878n(4555)
(custom)
|
|
| TP-Link Systems Inc. | EC225-G5(US1) V1.0 |
Affected:
0 , < 1.1.14.1 Build 250711 Rel.35607n(5553)
(custom)
|
|
| TP-Link Systems Inc. | EX141(BR) V1.0/1.9 |
Affected:
0 , < 1.8.0 3.1.0 v608a.0 Build 250425 Rel.40905n
(custom)
|
|
| TP-Link Systems Inc. | EX141(EU1) V1.0 |
Affected:
0 , < 1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n
(custom)
|
|
| TP-Link Systems Inc. | EX141(US1) V1.0 |
Affected:
0 , < 1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n
(custom)
|
|
| TP-Link Systems Inc. | EX220(BR) V1.0/1.20/1.28/1.29/1.8 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX220(BR) V2.0 |
Affected:
0 , < 0.19.0 2.0.0 v609b.0 Build 250814 Rel.49732n
(custom)
|
|
| TP-Link Systems Inc. | EX220(EU1) V1.0/1.20 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX220(RU) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX220(US1) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX222(EU1) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX222(KR) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v609b.0 Build 260427 Rel.16915
(custom)
|
|
| TP-Link Systems Inc. | EX222(US1) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX511(BR) V2.0/2.8/2.9 |
Affected:
0 , < 0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n
(custom)
|
|
| TP-Link Systems Inc. | EX511(EU1) V2.0 |
Affected:
0 , < 0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n
(custom)
|
|
| TP-Link Systems Inc. | EX511(US1) V2.0 |
Affected:
0 , < 0.8.0 3.0.0 v607e.0 Build 260424 Rel.27419n
(custom)
|
|
| TP-Link Systems Inc. | EX520(US1) V1.0 |
Affected:
0 , < 0.7.0 3.0.0 v60b4.0 Build 251229 Rel.84306n
(custom)
|
|
| TP-Link Systems Inc. | EX520v(EU1)1.0 |
Affected:
0 , < 0.1.0 3.0.0 v60ee.0 Build 250310 Rel.55637n
(custom)
|
|
| TP-Link Systems Inc. | EX521(US1) V1.0 |
Affected:
0 , < 0.3.0 3.0.0 v60e3.0 Build 250925 Rel.66797n
(custom)
|
|
| TP-Link Systems Inc. | EX820v(EU1) V1.0 |
Affected:
0 , < 0.4.0 3.1.9 v6087.0 Build 250928 Rel.59674n
(custom)
|
|
| TP-Link Systems Inc. | EX920(US2) V1.6/V1.0 |
Affected:
0 , < 0.8.0 3.2.2 v6080.0 Build 260309 Rel.54790n
(custom)
|
|
| TP-Link Systems Inc. | XC220-G3v(EU1) V2.30 |
Affected:
0 , < 1.16.0 0.8.0 v6062.0 Build 250817 Rel.23310n
(custom)
|
|
| TP-Link Systems Inc. | XC220-G3v(US1) V2.30 |
Affected:
0 , < 1.16.0 0.8.0 v6062.0 Build 250817 Rel.23310n
(custom)
|
|
| TP-Link Systems Inc. | XX530v(BR)v1.0 |
Affected:
0 , < 0.6.0 3.0.0 v6096.0 Build 250416 Rel.26048n
(custom)
|
|
| TP-Link Systems Inc. | XX530v(BR)v2.0 |
Affected:
0 , < 0.4.0 3.1.10 v60dc.0 Build 250520 Rel.69748n
(custom)
|
|
| TP-Link Systems Inc. | XX530v(US1) |
Affected:
0 , < 0.6.0 3.0.0 v6096.0 Build 250416 Rel.26048n
(custom)
|
|
| TP-Link Systems Inc. | XX530v(EU1) |
Affected:
0 , < 0.3.0 3.1.10 v6107.0 Build 250425 Rel.71973n
(custom)
|
|
| TP-Link Systems Inc. | XX230v(BR) V1.0 |
Affected:
0 , < 0.16.0 3.0.0 v6066.0 Build 250423 Rel.43799n
(custom)
|
|
| TP-Link Systems Inc. | VX800v(DE) V1.0 |
Affected:
0 , < 800.0.16
(custom)
|
|
| TP-Link Systems Inc. | VX1800v(EU1) V1.0 |
Affected:
0 , < 0.14.0 2.0.0 v6092.0 Build 250417 Rel.24761n
(custom)
|
|
| TP-Link Systems Inc. | VX420-G2h(AU) V3.0 |
Affected:
0 , < 0.2.0 2.0.0 v60df.0 Build 250427 Rel.38233n
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-30239",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T14:49:00.479124Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T14:49:10.875Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HB810(US2) V1.0/1.6/2.0/2.6",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB810(EU1) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB710(US2) V1.6/1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB710(EU1) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB610(US2) V2.6/2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB610(EU1)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB610(CA) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v60af.0 Build 251216 Rel.46954n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB410( EU1) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.0.0 v60bf.0 Build 250901 Rel.45574n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB210(US2) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB210(EU1) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB210 Pro(EU1)1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.5.0 3.0.0 v60d5.0 Build 250922 Rel.13742n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB210 Pro(US2)1.0/1.6",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.8.0 3.0.0 v60d5.0 Build 260318 Rel.78363n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX510(US1) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX510(EU1) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX510(CA) V1.0/2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX510(AU) V1.0/2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX510(US2) 2.6",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.17.0 3.2.2 v6065.0 Build 260722 Rel.10662n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX710(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.5.0 3.1.10 v6075.0 Build 260511 Rel.47847n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX710 Pro(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.4.0 3.1.10 v6082.0 Build 260204 Rel.49460n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX220(US1) V1.0/1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX220(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX220(CA) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX220(AU) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX141(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 3.1.0 v609d.0 Build 260128 Rel.29711n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HC220-G5(US1) V1.0/1.6",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.18.0 2.0.0 v605e.0 Build 250827 Rel.37904n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HC220-G5(EU1) V1.20/1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.18.0 2.0.0 v605e.0 Build 250827 Rel.37904n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HC220-G5(BR) V1.30",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.17.0 2.0.0 v605e.0 Build 250618 Rel.19329n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EB210 Pro(EU1) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EB210 Pro(US1) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EB810v(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v608b.0 Build 250613 Rel.10497n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EC220-G5(BR) V3.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.14.1 Build 250715 Rel.72650n(4252)",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EC220-G5(EU1) V3.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.15.1 Build 260205 Rel.38208n(4555)",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EC220-G5(US1) V3.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.14.1 Build 250715 Rel.72650n(4252)",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EC225-G5(BR) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.14.1 Build 250717 Rel.34953n(4252)",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EC225-G5(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.14.1 Build 250711 Rel.35878n(4555)",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EC225-G5(US1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.1.14.1 Build 250711 Rel.35607n(5553)",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX141(BR) V1.0/1.9",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.8.0 3.1.0 v608a.0 Build 250425 Rel.40905n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX141(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX141(US1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(BR) V1.0/1.20/1.28/1.29/1.8",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(BR) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.19.0 2.0.0 v609b.0 Build 250814 Rel.49732n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(EU1) V1.0/1.20",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(RU) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(US1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX222(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX222(KR) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v609b.0 Build 260427 Rel.16915",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX222(US1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX511(BR) V2.0/2.8/2.9",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX511(EU1) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX511(US1) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.8.0 3.0.0 v607e.0 Build 260424 Rel.27419n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX520(US1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.7.0 3.0.0 v60b4.0 Build 251229 Rel.84306n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX520v(EU1)1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.1.0 3.0.0 v60ee.0 Build 250310 Rel.55637n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX521(US1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.0.0 v60e3.0 Build 250925 Rel.66797n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX820v(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.4.0 3.1.9 v6087.0 Build 250928 Rel.59674n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX920(US2) V1.6/V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.8.0 3.2.2 v6080.0 Build 260309 Rel.54790n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XC220-G3v(EU1) V2.30",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.16.0 0.8.0 v6062.0 Build 250817 Rel.23310n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XC220-G3v(US1) V2.30",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.16.0 0.8.0 v6062.0 Build 250817 Rel.23310n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX530v(BR)v1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v6096.0 Build 250416 Rel.26048n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX530v(BR)v2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.4.0 3.1.10 v60dc.0 Build 250520 Rel.69748n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX530v(US1)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v6096.0 Build 250416 Rel.26048n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX530v(EU1)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.1.10 v6107.0 Build 250425 Rel.71973n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX230v(BR) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.16.0 3.0.0 v6066.0 Build 250423 Rel.43799n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VX800v(DE) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "800.0.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VX1800v(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.14.0 2.0.0 v6092.0 Build 250417 Rel.24761n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VX420-G2h(AU) V3.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.2.0 2.0.0 v60df.0 Build 250427 Rel.38233n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Gerhard Hechenberger, Stefan Schweighofer, Constantin Schieber-Knoebl from the SEC Consult Vulnerability Lab"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn affected TP-Link Aginet devices, u\u003cspan\u003ese of\nhardcoded cryptographic keys embedded in the firmware to protect sensitive\nconfiguration data may allow an attacker who has access to device storage to\nrecover the keys and decrypt stored data.\u003c/span\u003e\u003c/p\u003e\n\n\u003cp\u003eSuccessful\nexploitation may allow access to decrypted sensitive configuration data,\nincluding credentials and service-related information.\u0026nbsp;\u003c/p\u003e"
}
],
"value": "In affected TP-Link Aginet devices, use of\nhardcoded cryptographic keys embedded in the firmware to protect sensitive\nconfiguration data may allow an attacker who has access to device storage to\nrecover the keys and decrypt stored data.\n\n\n\n\n\nSuccessful\nexploitation may allow access to decrypted sensitive configuration data,\nincluding credentials and service-related information."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37: Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321: Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T22:25:03.690Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"name": "TP-Link Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5239/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Sensitive Data Exposure due to Hardcoded Cryptographic Keys in Multiple TP-Link Aginet Devices",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2025-30239",
"datePublished": "2026-08-10T22:25:03.690Z",
"dateReserved": "2025-03-19T11:09:33.244Z",
"dateUpdated": "2026-08-11T14:49:10.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-30238 (GCVE-0-2025-30238)
Vulnerability from cvelistv5 – Published: 2026-08-10 22:24 – Updated: 2026-08-11 14:23
VLAI
EPSS
VEX
Title
Privilege Escalation via Improper Authorization in User Management in multiple TP-Link Aginet Devices
Summary
In affected TP-Link Aginet devices, insufficient
authorization validation allows authenticated low-privileged users to execute higher-privileged
operations.
An attacker
may perform administrative actions such as creating privileged accounts or
modifying critical configuration settings.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 14:23 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.tp-link.com/us/support/faq/5239/ | vendor-advisory |
Impacted products
59 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | HB810(US2) V1.0/1.6/2.0/2.6 |
Affected:
0 , < 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n
(custom)
|
|
| TP-Link Systems Inc. | HB810(EU1) V2.0 |
Affected:
0 , < 0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567n
(custom)
|
|
| TP-Link Systems Inc. | HB710(US2) V1.6/1.0 |
Affected:
0 , < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n
(custom)
|
|
| TP-Link Systems Inc. | HB710(EU1) 1.0 |
Affected:
0 , < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n
(custom)
|
|
| TP-Link Systems Inc. | HB610(US2) V2.6/2.0 |
Affected:
0 , < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n
(custom)
|
|
| TP-Link Systems Inc. | HB610(EU1) |
Affected:
0 , < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n
(custom)
|
|
| TP-Link Systems Inc. | HB610(CA) V2.0 |
Affected:
0 , < 0.6.0 3.0.0 v60af.0 Build 251216 Rel.46954n
(custom)
|
|
| TP-Link Systems Inc. | HB410( EU1) 1.0 |
Affected:
0 , < 0.3.0 3.0.0 v60bf.0 Build 250901 Rel.45574n
(custom)
|
|
| TP-Link Systems Inc. | HB210(US2) 1.0 |
Affected:
0 , < 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n
(custom)
|
|
| TP-Link Systems Inc. | HB210(EU1) 1.0 |
Affected:
0 , < 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n
(custom)
|
|
| TP-Link Systems Inc. | HB210 Pro(EU1)1.0 |
Affected:
0 , < 0.5.0 3.0.0 v60d5.0 Build 250922 Rel.13742n
(custom)
|
|
| TP-Link Systems Inc. | HB210 Pro(US2)1.0/1.6 |
Affected:
0 , < 0.8.0 3.0.0 v60d5.0 Build 260318 Rel.78363n
(custom)
|
|
| TP-Link Systems Inc. | HX510(US1) V2.0 |
Affected:
0 , < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n
(custom)
|
|
| TP-Link Systems Inc. | HX510(EU1) V2.0 |
Affected:
0 , < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n
(custom)
|
|
| TP-Link Systems Inc. | HX510(CA) V1.0/2.0 |
Affected:
0 , < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n
(custom)
|
|
| TP-Link Systems Inc. | HX510(AU) V1.0/2.0 |
Affected:
0 , < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n
(custom)
|
|
| TP-Link Systems Inc. | HX510(US2) 2.6 |
Affected:
0 , < 0.17.0 3.2.2 v6065.0 Build 260722 Rel.10662n
(custom)
|
|
| TP-Link Systems Inc. | HX710(EU1) V1.0 |
Affected:
0 , < 0.5.0 3.1.10 v6075.0 Build 260511 Rel.47847n
(custom)
|
|
| TP-Link Systems Inc. | HX710 Pro(EU1) V1.0 |
Affected:
0 , < 0.4.0 3.1.10 v6082.0 Build 260204 Rel.49460n
(custom)
|
|
| TP-Link Systems Inc. | HX220(US1) V1.0/1.0 |
Affected:
0 , < 0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n
(custom)
|
|
| TP-Link Systems Inc. | HX220(EU1) V1.0 |
Affected:
0 , < 0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n
(custom)
|
|
| TP-Link Systems Inc. | HX220(CA) V1.0 |
Affected:
0 , < 0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n
(custom)
|
|
| TP-Link Systems Inc. | HX220(AU) V1.0 |
Affected:
0 , < 0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n
(custom)
|
|
| TP-Link Systems Inc. | HX141(EU1) V1.0 |
Affected:
0 , < 1.2.0 3.1.0 v609d.0 Build 260128 Rel.29711n
(custom)
|
|
| TP-Link Systems Inc. | HC220-G5(US1) V1.0/1.6 |
Affected:
0 , < 0.18.0 2.0.0 v605e.0 Build 250827 Rel.37904n
(custom)
|
|
| TP-Link Systems Inc. | HC220-G5(EU1) V1.20/1.0 |
Affected:
0 , < 0.18.0 2.0.0 v605e.0 Build 250827 Rel.37904n
(custom)
|
|
| TP-Link Systems Inc. | HC220-G5(BR) V1.30 |
Affected:
0 , < 0.17.0 2.0.0 v605e.0 Build 250618 Rel.19329n
(custom)
|
|
| TP-Link Systems Inc. | EB210 Pro(EU1) 1.0 |
Affected:
0 , < 0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n
(custom)
|
|
| TP-Link Systems Inc. | EB210 Pro(US1) 1.0 |
Affected:
0 , < 0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n
(custom)
|
|
| TP-Link Systems Inc. | EB810v(EU1) V1.0 |
Affected:
0 , < 0.6.0 3.0.0 v608b.0 Build 250613 Rel.10497n
(custom)
|
|
| TP-Link Systems Inc. | EX141(BR) V1.0/1.9 |
Affected:
0 , < 1.8.0 3.1.0 v608a.0 Build 250425 Rel.40905n
(custom)
|
|
| TP-Link Systems Inc. | EX141(EU1) V1.0 |
Affected:
0 , < 1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n
(custom)
|
|
| TP-Link Systems Inc. | EX141(US1) V1.0 |
Affected:
0 , < 1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n
(custom)
|
|
| TP-Link Systems Inc. | EX220(BR) V1.0/1.20/1.28/1.29/1.8 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX220(BR) V2.0 |
Affected:
0 , < 0.19.0 2.0.0 v609b.0 Build 250814 Rel.49732n
(custom)
|
|
| TP-Link Systems Inc. | EX220(EU1) V1.0/1.20 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX220(RU) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX220(US1) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX222(EU1) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX222(KR) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v609b.0 Build 260427 Rel.16915
(custom)
|
|
| TP-Link Systems Inc. | EX222(US1) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX511(BR) V2.0/2.8/2.9 |
Affected:
0 , < 0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n
(custom)
|
|
| TP-Link Systems Inc. | EX511(EU1) V2.0 |
Affected:
0 , < 0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n
(custom)
|
|
| TP-Link Systems Inc. | EX511(US1) V2.0 |
Affected:
0 , < 0.8.0 3.0.0 v607e.0 Build 260424 Rel.27419n
(custom)
|
|
| TP-Link Systems Inc. | EX520(US1) V1.0 |
Affected:
0 , < 0.7.0 3.0.0 v60b4.0 Build 251229 Rel.84306n
(custom)
|
|
| TP-Link Systems Inc. | EX520v(EU1)1.0 |
Affected:
0 , < 0.1.0 3.0.0 v60ee.0 Build 250310 Rel.55637n
(custom)
|
|
| TP-Link Systems Inc. | EX521(US1) V1.0 |
Affected:
0 , < 0.3.0 3.0.0 v60e3.0 Build 250925 Rel.66797n
(custom)
|
|
| TP-Link Systems Inc. | EX820v(EU1) V1.0 |
Affected:
0 , < 0.4.0 3.1.9 v6087.0 Build 250928 Rel.59674n
(custom)
|
|
| TP-Link Systems Inc. | EX920(US2) V1.6/V1.0 |
Affected:
0 , < 0.8.0 3.2.2 v6080.0 Build 260309 Rel.54790n
(custom)
|
|
| TP-Link Systems Inc. | XC220-G3v(EU1) V2.30 |
Affected:
0 , < 1.16.0 0.8.0 v6062.0 Build 250817 Rel.23310n
(custom)
|
|
| TP-Link Systems Inc. | XC220-G3v(US1) V2.30 |
Affected:
0 , < 1.16.0 0.8.0 v6062.0 Build 250817 Rel.23310n
(custom)
|
|
| TP-Link Systems Inc. | XX530v(BR)v1.0 |
Affected:
0 , < 0.6.0 3.0.0 v6096.0 Build 250416 Rel.26048n
(custom)
|
|
| TP-Link Systems Inc. | XX530v(BR)v2.0 |
Affected:
0 , < 0.4.0 3.1.10 v60dc.0 Build 250520 Rel.69748n
(custom)
|
|
| TP-Link Systems Inc. | XX530v(US1) |
Affected:
0 , < 0.6.0 3.0.0 v6096.0 Build 250416 Rel.26048n
(custom)
|
|
| TP-Link Systems Inc. | XX530v(EU1) |
Affected:
0 , < 0.3.0 3.1.10 v6107.0 Build 250425 Rel.71973n
(custom)
|
|
| TP-Link Systems Inc. | XX230v(BR) V1.0 |
Affected:
0 , < 0.16.0 3.0.0 v6066.0 Build 250423 Rel.43799n
(custom)
|
|
| TP-Link Systems Inc. | VX800v(DE) V1.0 |
Affected:
0 , < 800.0.16
(custom)
|
|
| TP-Link Systems Inc. | VX1800v(EU1) V1.0 |
Affected:
0 , < 0.14.0 2.0.0 v6092.0 Build 250417 Rel.24761n
(custom)
|
|
| TP-Link Systems Inc. | VX420-G2h(AU) V3.0 |
Affected:
0 , < 0.2.0 2.0.0 v60df.0 Build 250427 Rel.38233n
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-30238",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T14:23:04.042032Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T14:23:16.090Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HB810(US2) V1.0/1.6/2.0/2.6",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB810(EU1) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB710(US2) V1.6/1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB710(EU1) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB610(US2) V2.6/2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB610(EU1)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB610(CA) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v60af.0 Build 251216 Rel.46954n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB410( EU1) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.0.0 v60bf.0 Build 250901 Rel.45574n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB210(US2) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB210(EU1) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB210 Pro(EU1)1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.5.0 3.0.0 v60d5.0 Build 250922 Rel.13742n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB210 Pro(US2)1.0/1.6",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.8.0 3.0.0 v60d5.0 Build 260318 Rel.78363n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX510(US1) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX510(EU1) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX510(CA) V1.0/2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX510(AU) V1.0/2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX510(US2) 2.6",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.17.0 3.2.2 v6065.0 Build 260722 Rel.10662n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX710(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.5.0 3.1.10 v6075.0 Build 260511 Rel.47847n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX710 Pro(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.4.0 3.1.10 v6082.0 Build 260204 Rel.49460n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX220(US1) V1.0/1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX220(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX220(CA) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX220(AU) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX141(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 3.1.0 v609d.0 Build 260128 Rel.29711n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HC220-G5(US1) V1.0/1.6",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.18.0 2.0.0 v605e.0 Build 250827 Rel.37904n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HC220-G5(EU1) V1.20/1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.18.0 2.0.0 v605e.0 Build 250827 Rel.37904n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HC220-G5(BR) V1.30",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.17.0 2.0.0 v605e.0 Build 250618 Rel.19329n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EB210 Pro(EU1) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EB210 Pro(US1) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.2.0 3.0.0 v60f4.0 Build 250807 Rel.58901n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EB810v(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v608b.0 Build 250613 Rel.10497n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX141(BR) V1.0/1.9",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.8.0 3.1.0 v608a.0 Build 250425 Rel.40905n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX141(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX141(US1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(BR) V1.0/1.20/1.28/1.29/1.8",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(BR) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.19.0 2.0.0 v609b.0 Build 250814 Rel.49732n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(EU1) V1.0/1.20",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(RU) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(US1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX222(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX222(KR) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v609b.0 Build 260427 Rel.16915",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX222(US1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX511(BR) V2.0/2.8/2.9",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX511(EU1) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX511(US1) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.8.0 3.0.0 v607e.0 Build 260424 Rel.27419n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX520(US1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.7.0 3.0.0 v60b4.0 Build 251229 Rel.84306n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX520v(EU1)1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.1.0 3.0.0 v60ee.0 Build 250310 Rel.55637n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX521(US1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.0.0 v60e3.0 Build 250925 Rel.66797n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX820v(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.4.0 3.1.9 v6087.0 Build 250928 Rel.59674n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX920(US2) V1.6/V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.8.0 3.2.2 v6080.0 Build 260309 Rel.54790n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XC220-G3v(EU1) V2.30",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.16.0 0.8.0 v6062.0 Build 250817 Rel.23310n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XC220-G3v(US1) V2.30",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.16.0 0.8.0 v6062.0 Build 250817 Rel.23310n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX530v(BR)v1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v6096.0 Build 250416 Rel.26048n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX530v(BR)v2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.4.0 3.1.10 v60dc.0 Build 250520 Rel.69748n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX530v(US1)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v6096.0 Build 250416 Rel.26048n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX530v(EU1)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.1.10 v6107.0 Build 250425 Rel.71973n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX230v(BR) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.16.0 3.0.0 v6066.0 Build 250423 Rel.43799n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VX800v(DE) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "800.0.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VX1800v(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.14.0 2.0.0 v6092.0 Build 250417 Rel.24761n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VX420-G2h(AU) V3.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.2.0 2.0.0 v60df.0 Build 250427 Rel.38233n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Gerhard Hechenberger, Stefan Schweighofer, Constantin Schieber-Knoebl from the SEC Consult Vulnerability Lab"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn affected TP-Link Aginet devices, i\u003cspan\u003ensufficient\nauthorization validation allows authenticated low-privileged users to execute higher-privileged\noperations.\u003c/span\u003e\u003c/p\u003e\n\n\u003cp\u003eAn attacker\nmay perform administrative actions such as creating privileged accounts or\nmodifying critical configuration settings.\u003c/p\u003e"
}
],
"value": "In affected TP-Link Aginet devices, insufficient\nauthorization validation allows authenticated low-privileged users to execute higher-privileged\noperations.\n\n\n\n\n\nAn attacker\nmay perform administrative actions such as creating privileged accounts or\nmodifying critical configuration settings."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233: Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T22:24:20.322Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"name": "TP-Link Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5239/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Privilege Escalation via Improper Authorization in User Management in multiple TP-Link Aginet Devices",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2025-30238",
"datePublished": "2026-08-10T22:24:20.322Z",
"dateReserved": "2025-03-19T11:09:33.244Z",
"dateUpdated": "2026-08-11T14:23:16.090Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-30237 (GCVE-0-2025-30237)
Vulnerability from cvelistv5 – Published: 2026-08-10 22:23 – Updated: 2026-08-11 14:23
VLAI
EPSS
VEX
Title
Authentication Bypass via Broken Access Control in Web Server in Multiple TP-Link Aginet Devices
Summary
The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication
checks are not consistently enforced on certain endpoints. An attacker can send
specially crafted requests to bypass authentication and directly invoke
privileged functionality without valid credentials. This issue arises from
improper enforcement of access control mechanisms on sensitive operations.
Successful
exploitation may allow an unauthenticated attacker to execute privileged
operations and gain full control of the device.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 14:23 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.tp-link.com/us/support/faq/5239/ | vendor-advisory |
Impacted products
56 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | HB810(US2) V1.0/1.6/2.0/2.6 |
Affected:
0 , < 0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n
(custom)
|
|
| TP-Link Systems Inc. | HB810(EU1) V2.0 |
Affected:
0 , < 0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567n
(custom)
|
|
| TP-Link Systems Inc. | HB710(US2) V1.6/1.0 |
Affected:
0 , < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n
(custom)
|
|
| TP-Link Systems Inc. | HB710(EU1) 1.0 |
Affected:
0 , < 0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n
(custom)
|
|
| TP-Link Systems Inc. | HB610(US2) V2.6/2.0 |
Affected:
0 , < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n
(custom)
|
|
| TP-Link Systems Inc. | HB610(EU1) |
Affected:
0 , < 0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n
(custom)
|
|
| TP-Link Systems Inc. | HB610(CA) V2.0 |
Affected:
0 , < 0.6.0 3.0.0 v60af.0 Build 251216 Rel.46954n
(custom)
|
|
| TP-Link Systems Inc. | HB410( EU1) 1.0 |
Affected:
0 , < 0.3.0 3.0.0 v60bf.0 Build 250901 Rel.45574n
(custom)
|
|
| TP-Link Systems Inc. | HB210(US2) 1.0 |
Affected:
0 , < 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n
(custom)
|
|
| TP-Link Systems Inc. | HB210(EU1) 1.0 |
Affected:
0 , < 0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n
(custom)
|
|
| TP-Link Systems Inc. | HB210 Pro(EU1)1.0 |
Affected:
0 , < 0.5.0 3.0.0 v60d5.0 Build 250922 Rel.13742n
(custom)
|
|
| TP-Link Systems Inc. | HB210 Pro(US2)1.0/1.6 |
Affected:
0 , < 0.8.0 3.0.0 v60d5.0 Build 260318 Rel.78363n
(custom)
|
|
| TP-Link Systems Inc. | HX510(US1) V2.0 |
Affected:
0 , < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n
(custom)
|
|
| TP-Link Systems Inc. | HX510(EU1) V2.0 |
Affected:
0 , < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n
(custom)
|
|
| TP-Link Systems Inc. | HX510(CA) V1.0/2.0 |
Affected:
0 , < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n
(custom)
|
|
| TP-Link Systems Inc. | HX510(AU) V1.0/2.0 |
Affected:
0 , < 0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n
(custom)
|
|
| TP-Link Systems Inc. | HX510(US2) 2.6 |
Affected:
0 , < 0.17.0 3.2.2 v6065.0 Build 260722 Rel.10662n
(custom)
|
|
| TP-Link Systems Inc. | HX710(EU1) V1.0 |
Affected:
0 , < 0.5.0 3.1.10 v6075.0 Build 260511 Rel.47847n
(custom)
|
|
| TP-Link Systems Inc. | HX710 Pro(EU1) V1.0 |
Affected:
0 , < 0.4.0 3.1.10 v6082.0 Build 260204 Rel.49460n
(custom)
|
|
| TP-Link Systems Inc. | HX220(US1) V1.0/1.0 |
Affected:
0 , < 0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n
(custom)
|
|
| TP-Link Systems Inc. | HX220(EU1) V1.0 |
Affected:
0 , < 0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n
(custom)
|
|
| TP-Link Systems Inc. | HX220(CA) V1.0 |
Affected:
0 , < 0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n
(custom)
|
|
| TP-Link Systems Inc. | HX220(AU) V1.0 |
Affected:
0 , < 0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n
(custom)
|
|
| TP-Link Systems Inc. | HX141(EU1) V1.0 |
Affected:
0 , < 1.2.0 3.1.0 v609d.0 Build 260128 Rel.29711n
(custom)
|
|
| TP-Link Systems Inc. | HC220-G5(US1) V1.0/1.6 |
Affected:
0 , < 0.18.0 2.0.0 v605e.0 Build 250827 Rel.37904n
(custom)
|
|
| TP-Link Systems Inc. | HC220-G5(EU1) V1.20/1.0 |
Affected:
0 , < 0.18.0 2.0.0 v605e.0 Build 250827 Rel.37904n
(custom)
|
|
| TP-Link Systems Inc. | HC220-G5(BR) V1.30 |
Affected:
0 , < 0.17.0 2.0.0 v605e.0 Build 250618 Rel.19329n
(custom)
|
|
| TP-Link Systems Inc. | EX141(BR) V1.0/1.9 |
Affected:
0 , < 1.8.0 3.1.0 v608a.0 Build 250425 Rel.40905n
(custom)
|
|
| TP-Link Systems Inc. | EX141(EU1) V1.0 |
Affected:
0 , < 1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n
(custom)
|
|
| TP-Link Systems Inc. | EX141(US1) V1.0 |
Affected:
0 , < 1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n
(custom)
|
|
| TP-Link Systems Inc. | EX220(BR) V1.0/1.20/1.28/1.29/1.8 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX220(BR) V2.0 |
Affected:
0 , < 0.19.0 2.0.0 v609b.0 Build 250814 Rel.49732n
(custom)
|
|
| TP-Link Systems Inc. | EX220(EU1) V1.0/1.20 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX220(RU) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX220(US1) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX222(EU1) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX222(KR) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v609b.0 Build 260427 Rel.16915
(custom)
|
|
| TP-Link Systems Inc. | EX222(US1) V1.0 |
Affected:
0 , < 0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n
(custom)
|
|
| TP-Link Systems Inc. | EX511(BR) V2.0/2.8/2.9 |
Affected:
0 , < 0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n
(custom)
|
|
| TP-Link Systems Inc. | EX511(EU1) V2.0 |
Affected:
0 , < 0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n
(custom)
|
|
| TP-Link Systems Inc. | EX511(US1) V2.0 |
Affected:
0 , < 0.8.0 3.0.0 v607e.0 Build 260424 Rel.27419n
(custom)
|
|
| TP-Link Systems Inc. | EX520(US1) V1.0 |
Affected:
0 , < 0.7.0 3.0.0 v60b4.0 Build 251229 Rel.84306n
(custom)
|
|
| TP-Link Systems Inc. | EX520v(EU1)1.0 |
Affected:
0 , < 0.1.0 3.0.0 v60ee.0 Build 250310 Rel.55637n
(custom)
|
|
| TP-Link Systems Inc. | EX521(US1) V1.0 |
Affected:
0 , < 0.3.0 3.0.0 v60e3.0 Build 250925 Rel.66797n
(custom)
|
|
| TP-Link Systems Inc. | EX820v(EU1) V1.0 |
Affected:
0 , < 0.4.0 3.1.9 v6087.0 Build 250928 Rel.59674n
(custom)
|
|
| TP-Link Systems Inc. | EX920(US2) V1.6/V1.0 |
Affected:
0 , < 0.8.0 3.2.2 v6080.0 Build 260309 Rel.54790n
(custom)
|
|
| TP-Link Systems Inc. | XC220-G3v(EU1) V2.30 |
Affected:
0 , < 1.16.0 0.8.0 v6062.0 Build 250817 Rel.23310n
(custom)
|
|
| TP-Link Systems Inc. | XC220-G3v(US1) V2.30 |
Affected:
0 , < 1.16.0 0.8.0 v6062.0 Build 250817 Rel.23310n
(custom)
|
|
| TP-Link Systems Inc. | XX530v(BR)v1.0 |
Affected:
0 , < 0.6.0 3.0.0 v6096.0 Build 250416 Rel.26048n
(custom)
|
|
| TP-Link Systems Inc. | XX530v(BR)v2.0 |
Affected:
0 , < 0.4.0 3.1.10 v60dc.0 Build 250520 Rel.69748n
(custom)
|
|
| TP-Link Systems Inc. | XX530v(US1) |
Affected:
0 , < 0.6.0 3.0.0 v6096.0 Build 250416 Rel.26048n
(custom)
|
|
| TP-Link Systems Inc. | XX530v(EU1) |
Affected:
0 , < 0.3.0 3.1.10 v6107.0 Build 250425 Rel.71973n
(custom)
|
|
| TP-Link Systems Inc. | XX230v(BR) V1.0 |
Affected:
0 , < 0.16.0 3.0.0 v6066.0 Build 250423 Rel.43799n
(custom)
|
|
| TP-Link Systems Inc. | VX800v(DE) V1.0 |
Affected:
0 , < 800.0.16
(custom)
|
|
| TP-Link Systems Inc. | VX1800v(EU1) V1.0 |
Affected:
0 , < 0.14.0 2.0.0 v6092.0 Build 250417 Rel.24761n
(custom)
|
|
| TP-Link Systems Inc. | VX420-G2h(AU) V3.0 |
Affected:
0 , < 0.2.0 2.0.0 v60df.0 Build 250427 Rel.38233n
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-30237",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T14:23:38.414631Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T14:23:49.823Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HB810(US2) V1.0/1.6/2.0/2.6",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.9.0 3.2.2 v6095.0 Build 260717 Rel.67188n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB810(EU1) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.10.0 3.2.2 v6095.0 Build 260306 Rel.47567n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB710(US2) V1.6/1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB710(EU1) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.0.0 v60be.0 Build 251128 Rel.43956n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB610(US2) V2.6/2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB610(EU1)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v60af.0 Build 251204 Rel.20362n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB610(CA) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v60af.0 Build 251216 Rel.46954n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB410( EU1) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.0.0 v60bf.0 Build 250901 Rel.45574n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB210(US2) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB210(EU1) 1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.2.0 3.0.0 v60f9.0 Build 250826 Rel.47715n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB210 Pro(EU1)1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.5.0 3.0.0 v60d5.0 Build 250922 Rel.13742n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HB210 Pro(US2)1.0/1.6",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.8.0 3.0.0 v60d5.0 Build 260318 Rel.78363n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX510(US1) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX510(EU1) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX510(CA) V1.0/2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX510(AU) V1.0/2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.14.0 3.0.0 v6065.0 Build 250822 Rel.81150n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX510(US2) 2.6",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.17.0 3.2.2 v6065.0 Build 260722 Rel.10662n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX710(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.5.0 3.1.10 v6075.0 Build 260511 Rel.47847n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX710 Pro(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.4.0 3.1.10 v6082.0 Build 260204 Rel.49460n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX220(US1) V1.0/1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX220(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX220(CA) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX220(AU) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.21.0 2.0.0 v605f.0 Build 250306 Rel.9224n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HX141(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.2.0 3.1.0 v609d.0 Build 260128 Rel.29711n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HC220-G5(US1) V1.0/1.6",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.18.0 2.0.0 v605e.0 Build 250827 Rel.37904n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HC220-G5(EU1) V1.20/1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.18.0 2.0.0 v605e.0 Build 250827 Rel.37904n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HC220-G5(BR) V1.30",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.17.0 2.0.0 v605e.0 Build 250618 Rel.19329n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX141(BR) V1.0/1.9",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.8.0 3.1.0 v608a.0 Build 250425 Rel.40905n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX141(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX141(US1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.7.0 3.1.0 v608a.0 Build 250418 Rel.8257n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(BR) V1.0/1.20/1.28/1.29/1.8",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(BR) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.19.0 2.0.0 v609b.0 Build 250814 Rel.49732n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(EU1) V1.0/1.20",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(RU) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX220(US1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX222(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX222(KR) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v609b.0 Build 260427 Rel.16915",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX222(US1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.20.0 2.0.0 v605f.0 Build 250305 Rel.14728n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX511(BR) V2.0/2.8/2.9",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX511(EU1) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.9.0 3.0.0 v607e.0 Build 260520 Rel.33425n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX511(US1) V2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.8.0 3.0.0 v607e.0 Build 260424 Rel.27419n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX520(US1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.7.0 3.0.0 v60b4.0 Build 251229 Rel.84306n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX520v(EU1)1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.1.0 3.0.0 v60ee.0 Build 250310 Rel.55637n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX521(US1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.0.0 v60e3.0 Build 250925 Rel.66797n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX820v(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.4.0 3.1.9 v6087.0 Build 250928 Rel.59674n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX920(US2) V1.6/V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.8.0 3.2.2 v6080.0 Build 260309 Rel.54790n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XC220-G3v(EU1) V2.30",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.16.0 0.8.0 v6062.0 Build 250817 Rel.23310n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XC220-G3v(US1) V2.30",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.16.0 0.8.0 v6062.0 Build 250817 Rel.23310n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX530v(BR)v1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v6096.0 Build 250416 Rel.26048n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX530v(BR)v2.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.4.0 3.1.10 v60dc.0 Build 250520 Rel.69748n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX530v(US1)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.6.0 3.0.0 v6096.0 Build 250416 Rel.26048n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX530v(EU1)",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.3.0 3.1.10 v6107.0 Build 250425 Rel.71973n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XX230v(BR) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.16.0 3.0.0 v6066.0 Build 250423 Rel.43799n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VX800v(DE) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "800.0.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VX1800v(EU1) V1.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.14.0 2.0.0 v6092.0 Build 250417 Rel.24761n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VX420-G2h(AU) V3.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "0.2.0 2.0.0 v60df.0 Build 250427 Rel.38233n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Gerhard Hechenberger, Stefan Schweighofer, Constantin Schieber-Knoebl from the SEC Consult Vulnerability Lab"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe affected TP-Link Aginet devices\u003cspan\u003e\u0026nbsp;contain a flaw in the web management interface where authentication\nchecks are not consistently enforced on certain endpoints. An attacker can send\nspecially crafted requests to bypass authentication and directly invoke\nprivileged functionality without valid credentials. This issue arises from\nimproper enforcement of access control mechanisms on sensitive operations.\u003c/span\u003e\u003c/p\u003e\n\n\u003cp\u003eSuccessful\nexploitation may allow an unauthenticated attacker to execute privileged\noperations and gain full control of the device.\u003c/p\u003e"
}
],
"value": "The affected TP-Link Aginet devices\u00a0contain a flaw in the web management interface where authentication\nchecks are not consistently enforced on certain endpoints. An attacker can send\nspecially crafted requests to bypass authentication and directly invoke\nprivileged functionality without valid credentials. This issue arises from\nimproper enforcement of access control mechanisms on sensitive operations.\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated attacker to execute privileged\noperations and gain full control of the device."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115: Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T22:23:41.934Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"name": "TP-Link Security Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5239/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authentication Bypass via Broken Access Control in Web Server in Multiple TP-Link Aginet Devices",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2025-30237",
"datePublished": "2026-08-10T22:23:41.934Z",
"dateReserved": "2025-03-19T11:09:33.244Z",
"dateUpdated": "2026-08-11T14:23:49.823Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12339 (GCVE-0-2026-12339)
Vulnerability from cvelistv5 – Published: 2026-08-10 18:20 – Updated: 2026-08-25 23:31
VLAI
EPSS
VEX
Title
Authenticated Arbitrary File Write Vulnerability in multiple devices
Summary
A Zip Slip vulnerability in the WebUI ISP
Upgrade functionality allows arbitrary file write via a crafted archive
containing directory traversal sequences. An authenticated administrator may
overwrite arbitrary files on the system.Successful
exploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 14:44 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
8 references
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | TL-MR6400 v5.3 |
Affected:
0 , < (EU)_1.10.0 0.9.1 v0001.0 Build 260613 RC.76099n
(custom)
|
|
| TP-Link Systems Inc. | Archer MR600 v2 |
Affected:
0 , < (EU)_1.10.0 0.9.1 v0001.0 Build 260618 RC.40417n
(custom)
|
|
| TP-Link Systems Inc. | Archer MR200 v7 |
Affected:
0 , < (EU)_1.3.0 0.9.1 v0001.0 Build 260605 Rel.57870n
(custom)
|
|
| TP-Link Systems Inc. | TL-MR6400 v8.0 |
Affected:
0 , < (EU)_1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n
(custom)
|
|
| TP-Link Systems Inc. | TL-MR150 v3.20 |
Affected:
0 , < (EU)_1.3.0 0.9.1 v0001.0 Build 260720 Rel.59727n
(custom)
|
|
| TP-Link Systems Inc. | TL-MR100 v3.20 |
Affected:
0 , < (EU)_1.3.0 0.9.1 v0001.0 Build 260609 Rel.49957n
(custom)
Affected: 0 , < 1.1.0 0.9.1 v0001.0 Build 260609 Rel35479n, Customized Software for South Korea KT (custom) Affected: 0 , < 1.2.0 0.9.1 v0001.0 Build 260609 Rel.36250n, Customized Software for South Korea Telenor (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12339",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T14:44:35.924185Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T14:44:53.124Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TL-MR6400 v5.3",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "(EU)_1.10.0 0.9.1 v0001.0 Build 260613 RC.76099n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Archer MR600 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "(EU)_1.10.0 0.9.1 v0001.0 Build 260618 RC.40417n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Archer MR200 v7",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "(EU)_1.3.0 0.9.1 v0001.0 Build 260605 Rel.57870n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TL-MR6400 v8.0",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "(EU)_1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TL-MR150 v3.20",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "(EU)_1.3.0 0.9.1 v0001.0 Build 260720 Rel.59727n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TL-MR100 v3.20",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "(EU)_1.3.0 0.9.1 v0001.0 Build 260609 Rel.49957n",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "1.1.0 0.9.1 v0001.0 Build 260609 Rel35479n, \u00a0Customized Software for South Korea KT",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "1.2.0 0.9.1 v0001.0 Build 260609 Rel.36250n, Customized Software for South Korea Telenor",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "MrBruh"
},
{
"lang": "en",
"type": "finder",
"value": "haehet"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A Zip Slip vulnerability in the WebUI ISP\nUpgrade functionality allows arbitrary file write via a crafted archive\ncontaining directory traversal sequences. An authenticated administrator may\noverwrite arbitrary files on the system.\u003cdiv\u003eSuccessful\nexploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability. \u003c/div\u003e"
}
],
"value": "A Zip Slip vulnerability in the WebUI ISP\nUpgrade functionality allows arbitrary file write via a crafted archive\ncontaining directory traversal sequences. An authenticated administrator may\noverwrite arbitrary files on the system.Successful\nexploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability."
}
],
"impacts": [
{
"capecId": "CAPEC-17",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-17 Using Malicious Files"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T23:31:52.397Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/tl-mr6400/v5.30/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/archer-mr200/v7/#Firmware"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/en/support/faq/5237/"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/tl-mr100/v3.20/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/tl-mr150/v3.20/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/tl-mr6400/v8/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/kr/support/download/tl-mr100/v3.20/#Firmware"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated Arbitrary File Write Vulnerability in multiple devices",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-12339",
"datePublished": "2026-08-10T18:20:50.576Z",
"dateReserved": "2026-06-15T15:51:52.827Z",
"dateUpdated": "2026-08-25T23:31:52.397Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9031 (GCVE-0-2026-9031)
Vulnerability from cvelistv5 – Published: 2026-08-07 20:40 – Updated: 2026-08-10 18:23
VLAI
EPSS
VEX
Title
Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6
Summary
An input validation
vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation
of user-supplied data before it is processed by internal flash-write handling
logic.
Successful
exploitation may cause httpd process or device to crash, resulting in loss of access
to the web interface and a denial-of-service condition.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 17:23 UTC
CWE
- CWE-20 - Improper input validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.tp-link.com/us/support/download/arche… | patch |
| https://www.tp-link.com/en/support/download/arche… | patch |
| https://www.tp-link.com/en/support/faq/5234/ | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | Archer A6 v4 |
Affected:
0 , < V4_1.15.10 Build 260625 Rel.25447
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9031",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T17:23:21.410852Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T18:23:52.453Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"httpd"
],
"product": "Archer A6 v4",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V4_1.15.10 Build 260625 Rel.25447",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dariusz Go\u0144da"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn input validation\nvulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation\nof user-supplied data before it is processed by internal flash-write handling\nlogic.\u003c/p\u003e\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eSuccessful\nexploitation may cause httpd process or device to crash, resulting in loss of access\nto the web interface and a denial-of-service condition.\u003c/p\u003e"
}
],
"value": "An input validation\nvulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation\nof user-supplied data before it is processed by internal flash-write handling\nlogic.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may cause httpd process or device to crash, resulting in loss of access\nto the web interface and a denial-of-service condition."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T20:51:35.937Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/archer-a6/v4/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/archer-a6/v4/#Firmware"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/en/support/faq/5234/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-9031",
"datePublished": "2026-08-07T20:40:18.549Z",
"dateReserved": "2026-05-19T16:30:34.816Z",
"dateUpdated": "2026-08-10T18:23:52.453Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9030 (GCVE-0-2026-9030)
Vulnerability from cvelistv5 – Published: 2026-08-07 20:38 – Updated: 2026-08-10 18:23
VLAI
EPSS
VEX
Title
Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6
Summary
A denial-of-service
vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool
instruction handlng path in httpd does not properly synchronize or safely manage
concurrent systool operations.
By sending
crafted systool instructions through the asynchronous request path, successful
exploitation may cause the httpd process or device management service to crash
and may result in temporary loss of access to the web management interface or
device reboot.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 17:28 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.tp-link.com/us/support/download/arche… | patch |
| https://www.tp-link.com/en/support/download/arche… | patch |
| https://www.tp-link.com/en/support/faq/5234/ | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | Archer A6 v4 |
Affected:
0 , < V4_1.15.10 Build 260625 Rel.25447
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9030",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T17:28:38.437749Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T18:23:58.299Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"httpd"
],
"product": "Archer A6 v4",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V4_1.15.10 Build 260625 Rel.25447",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dariusz Go\u0144da"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA denial-of-service\nvulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool\ninstruction handlng path in httpd does not properly synchronize or safely manage\nconcurrent systool operations.\u0026nbsp; \u003c/p\u003e\n\n\u003cp\u003eBy sending\ncrafted systool instructions through the asynchronous request path, successful\nexploitation may cause the httpd process or device management service to crash\nand may result in temporary loss of access to the web management interface or\ndevice reboot.\u003c/p\u003e"
}
],
"value": "A denial-of-service\nvulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool\ninstruction handlng path in httpd does not properly synchronize or safely manage\nconcurrent systool operations.\u00a0 \n\n\n\n\n\nBy sending\ncrafted systool instructions through the asynchronous request path, successful\nexploitation may cause the httpd process or device management service to crash\nand may result in temporary loss of access to the web management interface or\ndevice reboot."
}
],
"impacts": [
{
"capecId": "CAPEC-125",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-125 Flooding"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T20:52:28.967Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/archer-a6/v4/#Firmware"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/archer-a6/v4/#Firmware"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/en/support/faq/5234/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-9030",
"datePublished": "2026-08-07T20:38:35.116Z",
"dateReserved": "2026-05-19T16:30:33.339Z",
"dateUpdated": "2026-08-10T18:23:58.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15314 (GCVE-0-2026-15314)
Vulnerability from cvelistv5 – Published: 2026-08-04 16:59 – Updated: 2026-08-05 17:47
VLAI
EPSS
VEX
Title
Authenticated Denial-of-Service Vulnerability in TP-Link Tapo P110
Summary
Tapo P110 v1
smart Wi-Fi Plug contains an improper boundary validation vulnerability in the
handling of authenticated HTTP request bodies due to insufficient input
validation before memory copy operations. This may lead to buffer overflow condition,
causing the web service process to crash.
Successful exploitation
may cause the web service process to stop responding or restart, resulting in a
denial-of-service condition.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-04 17:23 UTC
CWE
- CWE-120 - Buffer Copy without Checking Size of Input
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.tp-link.com/us/support/download/tapo-… | patch |
| https://www.tp-link.com/en/support/download/tapo-… | patch |
| https://www.tp-link.com/us/support/faq/5220/ | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | P110 v1 |
Affected:
0 , < V1_1.1.4 Build 260709
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15314",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T17:23:57.677349Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T17:24:10.234Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "P110 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V1_1.1.4 Build 260709",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Foo Min Zhan"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTapo P110 v1\nsmart Wi-Fi Plug contains an improper boundary validation vulnerability in the\nhandling of authenticated HTTP request bodies due to insufficient input\nvalidation before memory copy operations. This may lead to buffer overflow condition,\ncausing the web service process to crash.\u003c/p\u003e\n\n\u003cp\u003eSuccessful exploitation\nmay cause the web service process to stop responding or restart, resulting in a\ndenial-of-service condition.\u0026nbsp;\u003c/p\u003e"
}
],
"value": "Tapo P110 v1\nsmart Wi-Fi Plug contains an improper boundary validation vulnerability in the\nhandling of authenticated HTTP request bodies due to insufficient input\nvalidation before memory copy operations. This may lead to buffer overflow condition,\ncausing the web service process to crash.\n\n\n\n\n\nSuccessful exploitation\nmay cause the web service process to stop responding or restart, resulting in a\ndenial-of-service condition."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:47:43.539Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/tapo-p110/v1/#Firmware-Release-Notes"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/tapo-p110/v1/#Firmware-Release-Notes"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5220/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated Denial-of-Service Vulnerability in TP-Link Tapo P110",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-15314",
"datePublished": "2026-08-04T16:59:45.067Z",
"dateReserved": "2026-07-09T17:54:06.348Z",
"dateUpdated": "2026-08-05T17:47:43.539Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15631 (GCVE-0-2025-15631)
Vulnerability from cvelistv5 – Published: 2026-08-03 17:51 – Updated: 2026-08-03 18:29
VLAI
EPSS
VEX
Title
Weak Credential Storage in TP-Link Omada Devices
Summary
A
cryptographic weakness exists in affected Omada devices where site credentials
are protected using a legacy hashing algorithm that does not provide sufficient
protection.
An attacker
who obtains access to stored credential data may be able to recover valid credentials
to gain unauthorized access to affected devices or management environments.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 18:29 UTC
CWE
- CWE-759 - Use of a One-Way hash without a salt
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.omadanetworks.com/us/support/download/ | patch |
| https://www.omadanetworks.com/en/support/download/ | patch |
| https://www.tp-link.com/us/support/faq/5216/ | vendor-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | Omada Gateways |
Affected:
0
(custom)
|
|
| TP-Link Systems Inc. | Omada Switches |
Affected:
0
(custom)
|
|
| TP Link Systems Inc. | Omada Access Points |
Affected:
0
(custom)
|
|
| TP-Link Systems Inc. | Omada OLTs |
Affected:
0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-15631",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T18:29:21.933159Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T18:29:33.225Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Omada Gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Switches",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Points",
"vendor": "TP Link Systems Inc.",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada OLTs",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Stanislav Dashevskyi and Francesco La Spina of Forescout Technologies"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA\ncryptographic weakness exists in affected Omada devices where site credentials\nare protected using a legacy hashing algorithm that does not provide sufficient\nprotection.\u003c/p\u003e\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eAn attacker\nwho obtains access to stored credential data may be able to recover valid credentials\nto gain unauthorized access to affected devices or management environments.\u003c/p\u003e"
}
],
"value": "A\ncryptographic weakness exists in affected Omada devices where site credentials\nare protected using a legacy hashing algorithm that does not provide sufficient\nprotection.\n\n\n\n\n\n\n\n\n\nAn attacker\nwho obtains access to stored credential data may be able to recover valid credentials\nto gain unauthorized access to affected devices or management environments."
}
],
"impacts": [
{
"capecId": "CAPEC-55",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-55 Rainbow Table Password Cracking"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-759",
"description": "CWE-759 Use of a One-Way hash without a salt",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T17:51:52.265Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/us/support/download/"
},
{
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/en/support/download/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5216/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Weak Credential Storage in TP-Link Omada Devices",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2025-15631",
"datePublished": "2026-08-03T17:51:52.265Z",
"dateReserved": "2026-04-10T16:33:57.776Z",
"dateUpdated": "2026-08-03T18:29:33.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15630 (GCVE-0-2025-15630)
Vulnerability from cvelistv5 – Published: 2026-08-03 17:51 – Updated: 2026-08-03 18:30
VLAI
EPSS
VEX
Title
Device Provisioning Race Condition in TP-Link Omada Adoption Workflow
Summary
A race
condition exists in the cloud-based Omada device adoption process when an
attacker may be able to interact with the adoption workflow before a legitimate
device completes registration, resulting in provisioning information being
delivered to an attacker.
Successful
exploitation may allow disclosure of provisioning information intended for a
legitimate device.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 18:30 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.omadanetworks.com/us/support/download/ | patch |
| https://www.omadanetworks.com/en/support/download/ | patch |
| https://www.tp-link.com/us/support/faq/5216/ | vendor-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | Omada Gateways |
Affected:
0
(custom)
|
|
| TP-Link Systems Inc. | Omada Switches |
Affected:
0
(custom)
|
|
| TP Link Systems Inc. | Omada Access Points |
Affected:
0
(custom)
|
|
| TP-Link Systems Inc | Omada Controllers |
Affected:
0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-15630",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T18:30:34.469336Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T18:30:42.253Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Omada Gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Switches",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Points",
"vendor": "TP Link Systems Inc.",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Controllers",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Stanislav Dashevskyi and Francesco La Spina of Forescout Technologies"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA race\ncondition exists in the cloud-based Omada device adoption process when an\nattacker may be able to interact with the adoption workflow before a legitimate\ndevice completes registration, resulting in provisioning information being\ndelivered to an attacker.\u003c/p\u003e\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eSuccessful\nexploitation may allow disclosure of provisioning information intended for a\nlegitimate device.\u003c/p\u003e"
}
],
"value": "A race\ncondition exists in the cloud-based Omada device adoption process when an\nattacker may be able to interact with the adoption workflow before a legitimate\ndevice completes registration, resulting in provisioning information being\ndelivered to an attacker.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow disclosure of provisioning information intended for a\nlegitimate device."
}
],
"impacts": [
{
"capecId": "CAPEC-26",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-26 Leveraging Race Conditions"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T17:51:06.542Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/us/support/download/"
},
{
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/en/support/download/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5216/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Device Provisioning Race Condition in TP-Link Omada Adoption Workflow",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2025-15630",
"datePublished": "2026-08-03T17:51:06.542Z",
"dateReserved": "2026-04-10T16:33:55.447Z",
"dateUpdated": "2026-08-03T18:30:42.253Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15629 (GCVE-0-2025-15629)
Vulnerability from cvelistv5 – Published: 2026-08-03 17:50 – Updated: 2026-08-03 18:32
VLAI
EPSS
VEX
Title
Weak Session Key Generation in TP-Link Omada Adoption Protocol
Summary
A cryptographic
weakness exists in the Omada adoption protocol where session encryption keys
used to protect communications between controllers and managed devices may be
predictable due to insufficient entropy in session key generation.
An attacker
who successfully intercepts adoption-related communications may be able to recover
session encryption keys and decrypt affected communications.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 18:30 UTC
CWE
- CWE-331 - Insufficient entropy
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.omadanetworks.com/us/support/download/ | patch |
| https://www.omadanetworks.com/en/support/download/ | patch |
| https://www.tp-link.com/us/support/faq/5216/ | vendor-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | Omada Gateways |
Affected:
0
(custom)
|
|
| TP-Link Systems Inc. | Omada Switches |
Affected:
0
(custom)
|
|
| TP Link Systems Inc. | Omada Access Points |
Affected:
0
(custom)
|
|
| TP-Link Systems Inc | Omada Controllers |
Affected:
0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-15629",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T18:30:52.825327Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T18:32:11.317Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Omada Gateways",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Switches",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Access Points",
"vendor": "TP Link Systems Inc.",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Omada Controllers",
"vendor": "TP-Link Systems Inc",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Stanislav Dashevskyi and Francesco La Spina of Forescout Technologies"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA cryptographic\nweakness exists in the Omada adoption protocol where session encryption keys\nused to protect communications between controllers and managed devices may be\npredictable due to insufficient entropy in session key generation.\u003c/p\u003e\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eAn attacker\nwho successfully intercepts adoption-related communications may be able to recover\nsession encryption keys and decrypt affected communications.\u003c/p\u003e"
}
],
"value": "A cryptographic\nweakness exists in the Omada adoption protocol where session encryption keys\nused to protect communications between controllers and managed devices may be\npredictable due to insufficient entropy in session key generation.\n\n\n\n\n\n\n\n\n\nAn attacker\nwho successfully intercepts adoption-related communications may be able to recover\nsession encryption keys and decrypt affected communications."
}
],
"impacts": [
{
"capecId": "CAPEC-20",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-20 Encryption Brute Forcing"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-331",
"description": "CWE-331 Insufficient entropy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T17:50:44.038Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/us/support/download/"
},
{
"tags": [
"patch"
],
"url": "https://www.omadanetworks.com/en/support/download/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5216/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Weak Session Key Generation in TP-Link Omada Adoption Protocol",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2025-15629",
"datePublished": "2026-08-03T17:50:44.038Z",
"dateReserved": "2026-04-10T16:33:52.786Z",
"dateUpdated": "2026-08-03T18:32:11.317Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}