Vendor
TP-Link Systems
326 known vulnerabilities.
Products
11 results · Clear filters · Feed
-
Critical 9.3CVE-2026-19586 Public exploit
Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways
A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote …
-
Critical 9.3
Authenticated OS command execution
A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.
-
Critical 9.3
OS command injection in multiple parameters
An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.
-
Critical 9.2CVE-2025-40634 Public exploit
Stack-based buffer overflow in TP-Link Archer AX50
Stack-based buffer overflow vulnerability in the 'conn-indicator' binary running as root on the TP-Link Archer AX50 router, in firmware versions prior to 1.0.15 build 241203 rel61480. This vulnerability allows an attacker to execute arbitrary code on the devi…
-
Critical 9.8
TP-Link AX1800 hotplugd Firewall Rule Race Condition Vulnerability
TP-Link AX1800 hotplugd Firewall Rule Race Condition Vulnerability. This vulnerability allows remote attackers to gain access to LAN-side services on affected installations of TP-Link Archer AX21 routers. Authentication is not required to exploit this vulnera…
-
Critical 9.8
Authenticated RCE
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TP-Link TP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD-W9970, Tp-Link TD-W9970v3, TP-Link VX220-G2u, TP-Link VN020-G2u allows authenticate…
-
Critical 9.8
TP-Link SG105PE firmware prior to 'TL-SG105PE(UN) 1.0_1.0.0 Build 20221208' contains an authentication bypass vulnerabi…
-
Critical 9.8
A vulnerable HTTP Basic Authentication process in TP-Link routers, Archer C5 and WR710N-V1, is susceptible to either a DoS or an arbitrary code execution via any interface.
In TP-Link routers, Archer C5 and WR710N-V1, running the latest available code, when receiving HTTP Basic Authentication the httpd service can be sent a crafted packet that causes a heap overflow. This can result in either a DoS (by crashing the httpd process…
-
Critical 9.8
TP-LINK Tapo C200 remote code execution vulnerability
TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root. The exploitation of this vulnerability allows an attacker to take full control…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer C90 1.…
-
Critical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Fir…