Skip to content
OpenAdvisories
Critical · 9.3 CVE-2025-6542 EUVD-2025-35117GHSA-v223-4hv2-g25q

OS command injection in multiple parameters

Published Oct 21, 2025 · Updated Oct 21, 2025 · Assigned by TPLink

Vendor: TP-Link Systems Product: Festa gateways Product: Omada Gateways Product: Omada Pro gateways Category: Network devices

Description

An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.

Affected products

VendorProductAffectedFixed
TP-Link Systems Omada gateways < ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3 ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3
TP-Link Systems Festa gateways < FR365 1.1.10, FR205 1.0.3, FR307 1.2.5 FR365 1.1.10, FR205 1.0.3, FR307 1.2.5
TP-Link Systems Omada Pro gateways < G36 1.1.4, G611 1.2.2 G36 1.1.4, G611 1.2.2

References