Vendor
TP-Link Systems
326 known vulnerabilities.
Products
106 results · Clear filters · Feed
-
Medium 4.6
Information Disclosure via Diagnostic Interface Due to Improper Input Validation on TP-Link's Archer AX72
In the web management interface of Archer AX72 (SG) v1, the network diagnostic feature improperly handles invalid user input, resulting in limited exposure of diagnostic command usage information. An authenticated attacker with administrative privileges coul…
-
Medium 4.3
TP-Link TL-WR720N CSRF via Administrative Interfaces (firmware V1_130719)
TP-Link TL-WR720N wireless router contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious web requests. Attackers can modify port forwarding rules via VirtualServerRpm.htm …
-
Medium 6.1
Predictable Default Cryptographic Key Used for DES Encryption in TP-Link TL-WL841N
TP-Link TL-WR841N v13 uses DES-CBC encryption in the TDDPv2 debug protocol with a cryptographic key derived from default web management credentials, making the key predictable if device is left in default configuration. A network-adjacent attacker can exploit…
-
Medium 5.4
Use of weak cryptographic key in TP-Link Archer C7
Inadequate Encryption Strength vulnerability in TP-Link Archer C7 v5 and v5.8 (uhttpd modules) allows Password Recovery Exploitation. The web interface encrypts the admin password client-side using RSA-1024 before sending it to the router during login. An ad…
-
Medium 6.8
Arbitrary File Reading Vulnerability in dnsmasq Module in TP-Link AX53
An external configuration control vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary files when a malicious configuration file is processed. Successful exploitation may allow unauthorized acces…
-
Medium 6.8
Arbitrary File Reading Vulnerability in OpenVPN Module in TP-Link AX53
An external control of configuration vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary file when a malicious configuration file is processed. Successful exploitation may allow unauthorized ac…
-
Medium 5.1
Cleartext Storage of Administrative and Wi-Fi Credentials via Accessible Serial Interface in TP Link's TL-WR850N
The vulnerability affecting TL-WR850N v3 allows cleartext storage of administrative and Wi-Fi credentials in a region of the device’s flash memory while the serial interface remains enabled and protected by weak authentication. An attacker with physical acces…
-
Medium 6.9
Unauthenticated Denial-of-Service Vulnerability in Omada EAP610
A denial-of-service (DoS) vulnerability was identified in Omada EAP610 v3. An attacker with adjacent network access can send crafted requests to cause the device’s HTTP service to crash. This results in temporary service unavailability until the device is reb…
-
Medium 6.9
Path Traversal on TP-Link Deco BE25
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TP-Link Deco BE25 v1.0 (web modules) allows authenticated adjacent attacker to read arbitrary files or cause denial of service. This issue affects Deco BE25 v1.0:…
-
Medium 5.3
Reflected XSS Vulnerability on TP-Link Archer C60
User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted URL. An attacker could run script in the device web UI context, potentially enabling credential the…
-
Medium 6.9CVE-2026-0651 Public exploit
Path Traversal on TP-Link Tapo D235, C211, C520WS and C260 via Local https
A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to using the …
-
Medium 5.9
LAN Code Execution on TP-Link Archer MR200, Archer C20, TL-WR850N and TL-WR845N
The response coming from TP-Link Archer MR200 v5.2, C20 v5 and v6, TL-WR850N v3, and TL-WR845N v4 for any request is getting executed by the JavaScript function like eval directly without any check. Attackers can exploit this vulnerability via a Man-in-the-Mi…
-
Medium 6.0
L2TP over IPSec Encryption Failure on ArcherAXE75
When configured as L2TP/IPSec VPN server, Archer AXE75 V1 may accept connections using L2TP without IPSec protection, even when IPSec is enabled. This allows VPN sessions without encryption, exposing data in transit and compromising confidentiality.
-
Medium 6.8
Improper Input Validation Leading to DoS on TP-Link Archer BE230
An authenticated user with high privileges may trigger a denial‑of‑service condition in TP-Link Archer BE230 v1.2 by restoring a crafted configuration file containing an excessively long parameter. Restoring such a file can cause the device to become unrespon…
-
Medium 6.8
Improper Input Validation Leading to DoS on TP-Link Archer BE230
A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web modules) may allow a crafted request to cause the device’s web service to become unresponsive, resulting in a denial of service condition. A network adjacent attac…
-
Medium 5.3
Missing Application-Layer Encryption in Web Interface Endpoints on TP-Link VX800v
Some VX800v v1.0 web interface endpoints transmit sensitive information over unencrypted HTTP due to missing application layer encryption, allowing a network adjacent attacker to intercept this traffic and compromise its confidentiality.
-
Medium 5.1
Read-Only Root Access via USB Storage Device in TP-Link VX800v
Improper link resolution in USB HTTP access path in VX800v v1.0 allows a crafted USB device to expose root filesystem contents, giving an attacker with physical access read‑only access to system files.
-
Medium 6.3
Denial of Service (DoS) of VoIP Communication on TP-Link VX800v
Improper handling of exceptional conditions in VX800v v1.0 in SIP processing allows an attacker to flood the device with crafted INVITE messages, blocking all voice lines and causing a denial of service on incoming calls.
-
Medium 6.9
Access to System Files via SFTP on TP-Link VX800v
Improper link resolution in the VX800v v1.0 SFTP service allows authenticated adjacent attackers to use crafted symbolic links to access system files, resulting in high confidentiality impact and limited integrity risk.
-
Medium 5.1
Blind Server-Side Request Forgery (SSRF) in Omada Controller
Blind Server-Side Request Forgery (SSRF) in Omada Controllers through webhook functionality, enabling crafted requests to internal services, which may lead to enumeration of information.
-
Medium 6.0
Authentication Weakness on Omada Controllers, Gateways and Access Points
An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption t…
-
Medium 5.7
Cross-Site Scripting (XSS) on Omada Controllers
A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as network positioning or emulating a trusted entity, and user interaction by an …
-
Medium 6.3
Null Pointer Dereference Vulnerability on TL-WR841N
A Null Pointer Dereference vulnerability exists in the referer header check of the web portal of TP-Link TL-WR841N v14, caused by improper input validation. A remote, unauthenticated attacker can exploit this flaw and cause Denial of Service on the web porta…
-
Medium 6.9
Arbitrary File Deletion Vulnerability in TP-Link Archer AXE75
Improper Input Validation vulnerability in TP-Link Archer AXE75 v1.6 (vpn modules) allows an authenticated adjacent attacker to delete arbitrary server file, leading to possible loss of critical system files and service interruption or degraded functionality.…
-
Medium 6.0CVE-2025-14175 Public exploit
Weak Algorithm Support in SSH Server on TL-WR820N
A vulnerability in the SSH server of TP-Link TL-WR820N v2.80 allows the use of a weak cryptographic algorithm, enabling an adjacent attacker to intercept and decrypt SSH traffic. Exploitation may expose sensitive information and compromise confidentiality.
-
Medium 6.8
Uninitialized Pointer Vulnerability in TP-Link WR940N and WR941ND
Access of Uninitialized Pointer vulnerability in TP-Link WR940N and WR941ND allows local unauthenticated attackers the ability to execute DoS attack and potentially arbitrary code execution under the context of the ‘root’ user.This issue affects WR940N and WR…
-
Medium 5.7
Configuration Disclosure Vulnerability in TP-Link WA850RE
Improper authentication vulnerability in TP-Link WA850RE (httpd modules) allows unauthenticated attackers to download the configuration file.This issue affects: ≤ WA850RE V2_160527, ≤ WA850RE V3_160922.
-
Medium 6.9
TP-Link TL-WR841N Wan6to4TunnelCfgRpm.htm buffer overflow
A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/Wan6to4TunnelCfgRpm.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the web service and result in a…
-
Medium 6.9
TP-Link TL-WR841N WzdWlanSiteSurveyRpm_AP.htm buffer overflow
A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WzdWlanSiteSurveyRpm_AP.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the web service and result …
-
Medium 6.9
TP-Link TL-WR841N WlanNetworkRpm_APC.htm buffer overflow
A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WlanNetworkRpm_APC.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the web service and result in a …
-
Medium 6.9
TP-Link TL-WR841N WlanNetworkRpm_AP.htm buffer overflow
A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WlanNetworkRpm_AP.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the web service and result in a d…
-
Medium 6.9
TP-Link TL-WR841N, TL-WR842ND and TL-WR949N WlanNetworkRpm.htm buffer overflow
A vulnerability has been found in TP-Link TL-WR841N v11, TL-WR842ND v2 and TL-WR494N v3. The vulnerability exists in the /userRpm/WlanNetworkRpm.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the …
-
Medium 6.9
Hardcoded DES Decryption Keys in TP-Link Archer C50 V3/V4/V5 and C20 V5
Use of Hard-coded Credentials in TP-Link Archer C50 V3( <= 180703)/V4( <= 250117 )/V5( <= 200407 ), and C20 V5 (<US_V5_260419 or <EU_V5_260317) allows attackers to decrypt the config.xml files.
-
Medium 4.8
Tapo privilege escalation on shared devices using notifications
When a notification relating to low battery appears for a user with whom the device has been shared, tapping the notification grants full access to the power settings of that device.
-
Medium 4.4
Information Disclosure Vulnerability in TP-Link Tapo IoT Smart Hub
This vulnerability exists in TP-Link Tapo H200 V1 IoT Smart Hub due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtai…
-
Medium 4.3
TP-Link TL-SG108E clickjacking
A vulnerability was found in TP-Link TL-SG108E 1.0.0 Build 20201208 Rel. 40304. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to clickjacking. The attack may be initiated remotely. Upgrading to version 1.…
-
Medium 6.3CVE-2024-12344 Public exploit
TP-Link VN020 F3v(T) FTP USER Command memory corruption
A vulnerability, which was classified as critical, was found in TP-Link VN020 F3v(T) TT_V6.2.1021. This affects an unknown part of the component FTP USER Command Handler. The manipulation leads to memory corruption. It is possible to initiate the attack remot…
-
Medium 6.5
TP-Link VN020 F3v(T) SOAP Request WANIPConnection buffer overflow
A vulnerability classified as critical has been found in TP-Link VN020 F3v(T) TT_V6.2.1021. Affected is an unknown function of the file /control/WANIPConnection of the component SOAP Request Handler. The manipulation of the argument NewConnectionType leads to…
-
Medium 6.5CVE-2024-12342 Public exploit
TP-Link VN020 F3v(T) Incomplete SOAP Request WANIPConnection denial of service
A vulnerability was found in TP-Link VN020 F3v(T) TT_V6.2.1021. It has been rated as critical. This issue affects some unknown processing of the file /control/WANIPConnection of the component Incomplete SOAP Request Handler. The manipulation leads to denial o…
-
Medium 4.3
Exposure of Wi-Fi Credentials in Plaintext in TP-Link Archer C50
This vulnerability exists in the TP-Link Archer C50 due to presence of terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by accessing the UART shell on the vulnerable device. Successful ex…