Omada Gateways CVE-2025-7850
CRITICALAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent-network access to gateway
-
DeliveryAuthenticate to Omada web portal as admin
-
ExploitInject OS command via crafted portal input
-
ExecutionExecute arbitrary commands on gateway OS
-
ImpactPivot into protected network
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires valid administrator authentication to the Omada gateway web management portal (PR:H) - this is explicitly a post-admin-authentication flaw per the description - AND adjacent-network reachability to that portal (AV:A), meaning the attacker must be positioned on the same local/adjacent network segment rather than exploiting across the open internet. No end-user interaction is needed (UI:N) and attack complexity is low (AC:L) once those prerequisites are met. Limiting factors that reduce real-world risk: the administrator credential requirement, the adjacent-access constraint (management interfaces should not be internet-exposed), and applicability only to the listed Omada/Omada Pro/Festa gateway firmware (ER8411, ER7412-M2, ER707-M2, ER7206, ER605 and related models). |
| Impact | This is a genuinely serious flaw (CVSS 4.0 base 9.3, CWE-78 OS command injection yielding VC:H/VI:H/VA:H) but several signals temper its real-world priority. The authoritative CVSS 4.0 vector is AV:A (adjacent network, NOT internet-routable by default) and PR:H (high privileges), and the description confirms exploitation occurs 'after the admin's authentication on the web portal' - so an attacker must already hold valid administrator credentials AND reach the device from an adjacent/local network segment. That combination substantially narrows the realistic threat versus a remote-unauthenticated bug. EPSS is 3.31% (88th percentile): elevated attention but well below the near-certain-exploitation band, consistent with the high barrier to entry. There is no CISA KEV listing and no confirmed public exploit in the provided data, so exploitation is not demonstrated in the wild. One consideration to verify: the Forescout reference ('a primer on rooting routers') suggests active security research into this product family, which can foreshadow POC development, but no exploit is confirmed in the input. Net: a high-severity, post-authentication, adjacent-access issue - patch promptly on exposed/multi-tenant management networks, but it is not a drop-everything internet-facing emergency. |
| Exploit ScenarioDerived | An attacker who has obtained (or been legitimately granted) administrator credentials for an Omada gateway's web portal, and who can reach the device on the adjacent/local network, submits crafted input to a vulnerable portal field that is passed unsanitized to an OS shell. This injects and executes arbitrary operating-system commands on the gateway with device-level privileges, enabling full device takeover and pivoting into the protected network. No public exploit is identified at time of analysis, though vendor and third-party (Forescout) research on this router family exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
OS command injection in the web management portal of TP-Link Omada gateways (Omada, Omada Pro, and Festa lines) lets an attacker with valid administrator credentials execute arbitrary shell commands on the underlying device, with high confidentiality, integrity, and availability impact to the gateway and limited scope change to connected systems. Exploitation is gated by two prerequisites assessed from the vector: administrator authentication to the portal (PR:H) and adjacent-network reachability to that management interface (AV:A), so internet-exposed management portals are not the expected attack path and no public exploit code was identified at time of analysis. EPSS sits at roughly 3.3% (88th percentile), indicating elevated relative attention versus typical CVEs but not evidence of active exploitation - this CVE is not in CISA KEV.
RemediationAI
Patch status: patch available per vendor advisory - consult the Omada security advisory at https://support.omadanetworks.com/en/document/108456/ for the fixed firmware build per model and upgrade every in-scope ER605, ER7206, ER707-M2, ER7412-M2, ER8411, ER706W, ER7212PC, FR205, FR307-M2, FR365, G36, and G611 unit; because this is a command injection in the web portal, upgrading is the only complete fix and no configuration toggle removes the vulnerable handler. Where immediate upgrade is not possible, apply compensating controls that directly attack the prerequisites: remove management-plane exposure by placing the gateway web portal on a dedicated, tightly ACL'd management VLAN reachable only from a jump host, since the assessed attack vector is adjacent-network (AV:A) and this materially shrinks the attacker population; disable remote/cloud management and any WAN-side administrative access on the portal, accepting that this breaks out-of-band administration; and rotate administrator credentials and enforce unique, strongly scoped admin accounts, since exploitation requires valid admin authentication (PR:H) and credential reuse converts a remote attacker into an eligible one. Monitor gateway logs for anomalous authenticated POST requests to configuration and diagnostic endpoints, and treat any suspicious shell activity on the device as full compromise requiring reimage plus review of downstream trust relationships, given the assessed scope change (S:C).
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-78 improper neutralization of special elements used in an OS command, occurring in the embedded web management portal that ships on the affected Omada gateway firmware images (CPE entries cover tp-link er8411_firmware 1.3.3, er7412-m2_firmware 1.1.0, er707-m2_firmware 1.3.1, er7206_firmware 2.2.2, and er605_firmware 2.3.1, plus additional tagged models). Gateway management UIs of this class typically expose CGI/HTTP handlers that shell out to system utilities for diagnostics, network configuration, or firmware operations; when user-supplied parameters reach a shell without sanitization, an authenticated operator can break out of the intended command and run arbitrary binaries with the portal's process privileges - effectively full device compromise. The independent assessment rates this CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, meaning the attack surface is the adjacent network segment (management VLAN or local L2 domain), no user interaction is required, and because the gateway is a network chokepoint the scope change means downstream devices inheriting the gateway's trust are also at risk. Root cause is purely a missing input-sanitization/parameterization control at the web-to-shell boundary rather than a cryptographic or logic weakness.
Know when Er605 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H
Adjacent management access (AV:A) and mandatory admin login (PR:H) with low complexity; command injection on the gateway compromises the downstream network, so S:C with full C/I/A impact.
Primary rating from Vendor (f23511db-6c3e-4e32-a477-6aa17d310630).
CVSS VectorVendor: f23511db-6c3e-4e32-a477-6aa17d310630
DescriptionCVE.org
A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.
Executive ViewAI
TP-Link Omada, Omada Pro, and Festa gateways contain a critical OS command injection flaw in the web management portal that lets an authenticated administrator execute arbitrary shell commands on the device, putting network management and connected systems at risk. Exposure is concentrated among organizations with weak administrator credential controls or insufficient segmentation around the management interface, so leadership should prioritize access governance and network isolation while a vendor fix is pending. No public exploit identified at time of analysis, but no vendor-released patch identified at time of analysis, meaning risk remains until mitigations and fixed firmware are available.
Restrict the web management portal to a dedicated administrator VLAN or trusted adjacent network, enforce MFA and least-privilege administrator accounts, rotate credentials and remove default or shared accounts, segment gateways from user and internal networks, monitor gateway logs for anomalous command execution, and maintain offline configuration backups.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)CVE.org
More in Er605 Firmware
View allUnauthenticated OS command injection in TP-Link Omada router firmware lets remote attackers execute arbitrary OS command
Root shell escape on TP-Link Omada gateways allows an attacker who already holds high-privilege administrative access to
Authenticated command injection in TP-Link Omada business and SOHO routers allows a user who can log in to the web manag
An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption d
GitHub PoC
Exploit-DB