TP-Link Omada Routers CVE-2025-6541

Exploitation requires the attacker to successfully authenticate to the router's web management interface (CVSS PR:H) - the flaw lets a logged-in user run arbitrary OS commands on the device. The limiting factors are therefore: valid management credentials (admin or equivalent privileged account) and network reachability to the management interface. Risk rises sharply where the management plane is exposed beyond trusted operators, uses default/shared/weak credentials, or is reachable from WAN; it is substantially contained where management access is restricted to a trusted LAN segment and strong unique credentials are enforced. No special non-default product feature is named in the description - the vulnerable surface is the standard web management interface itself.

This is an authenticated command-injection flaw (CWE-78) in TP-Link/Omada business and SOHO routers. The only CVSS vector supplied is CVSS 4.0 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N), scoring 8.6. The signals are internally consistent but point to a conditional threat: network-reachable and low-complexity, yet PR:H means the attacker must already be able to log in to the web management interface, so this is a privilege-to-full-device-compromise escalation rather than a pre-auth breach. EPSS is low (0.69%, 52th percentile), there is no KEV listing and no POC in the provided data, which aligns with the authentication barrier - exploitation requires existing management access, limiting mass, automated abuse. The high 8.6 is driven by the full C/I/A compromise of the device (OS command execution) once authenticated, not by ease of reaching that state. Net: real and serious for any router whose management plane is exposed to untrusted users or protected only by weak/default/shared credentials, but it is not a drop-everything internet-worm scenario. Note the input lists far more product tags (ER605, ER707 M2, ER7206, ER8411, FR365, etc.) than the CPE set (ER706W, ER706W-4G, ER7212PC, G36, G611) - the true affected-product list should be confirmed against the Omada advisory.

An attacker with valid credentials to the router's web management interface (for example a low-trust internal operator, or an attacker who phished/reused admin credentials or exploited exposed management on a VPN/branch gateway) submits a crafted value into a management field that is passed unsanitized to an OS shell. The injected command runs with the web interface's privileges, giving full control of the router. No public exploit code was identified at time of analysis, and user interaction is not required.