Skip to content
OpenAdvisories
Critical · 9.3 CVE-2025-7850 EUVD-2025-35116GHSA-5r6g-vjqj-7mwg

Authenticated OS command execution

Published Oct 21, 2025 · Updated Oct 24, 2025 · Assigned by TPLink

Vendor: TP-Link Systems Product: Festa gateways Product: Omada Gateways Product: Omada Pro gateways Category: Network devices

Description

A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.

Affected products

VendorProductAffectedFixed
TP-Link Systems Omada gateways < ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3 ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3
TP-Link Systems Festa gateways < FR365 1.1.10, FR205 1.0.3, FR307 1.2.5 FR365 1.1.10, FR205 1.0.3, FR307 1.2.5
TP-Link Systems Omada Pro gateways < G36 1.1.4, G611 1.2.2 G36 1.1.4, G611 1.2.2

References