Skip to content
OpenAdvisories
High · 8.6 CVE-2025-6541 EUVD-2025-35118GHSA-x52x-mhfj-w7qq

OS command injection using information obtained from the web management interface

Published Oct 21, 2025 · Updated Oct 21, 2025 · Assigned by TPLink

Vendor: TP-Link Systems Product: Festa gateways Product: Omada Gateways Product: Omada Pro gateways Category: Network devices

Description

An arbitrary OS command may be executed on the product by the user who can log in to the web management interface.

Affected products

VendorProductAffectedFixed
TP-Link Systems Omada gateways < ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3 ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3
TP-Link Systems Festa gateways < FR365 1.1.10, FR205 1.0.3, FR307 1.2.5 FR365 1.1.10, FR205 1.0.3, FR307 1.2.5
TP-Link Systems Omada Pro gateways < G36 1.1.4, G611 1.2.2 G36 1.1.4, G611 1.2.2

References