EUVD-2026-63544
GHSA-32hp-8pjq-2c8g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, unauthenticated, low-complexity pre-auth command injection (AV:N/AC:L/PR:N/UI:N) yielding full device compromise, so C/I/A:H; scope kept U as impact is on the vulnerable device itself.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.
Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device.
AnalysisAI
Pre-authentication OS command injection in TP-Link Omada gateways (ER-series and DR-series VPN routers) lets an unauthenticated remote attacker execute arbitrary commands when the device is configured as an OpenVPN Server, because client-supplied data is insufficiently validated during OpenVPN connection establishment before authentication completes. Successful exploitation can yield full device compromise (CVSS 4.0 9.3, CWE-78). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The OpenVPN Server feature must be explicitly enabled on the Omada gateway, the OpenVPN service (its listening UDP/TCP port) must be network-reachable by the attacker, and the attacker must be able to initiate an OpenVPN connection attempt to the device. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals align toward high priority: CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N gives network-reachable, low-complexity, unauthenticated exploitation with high confidentiality, integrity and availability impact (VC/VI/VA:H) plus low subsequent-system impact, scoring 9.3. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker locates an internet-facing Omada gateway with the OpenVPN Server enabled and initiates an OpenVPN connection to it. During the pre-authentication handshake they supply crafted client input that the gateway passes into a backend command, executing attacker-chosen OS commands as the device's service account and gaining control of the perimeter gateway. … |
| Remediation | Patch available per vendor advisory - upgrade each affected device to at least the fixed build listed for its exact model (e.g., ER605 v2 to 2.4.4 Build 20260630 Rel.14398, ER8411 v1 to 1.4.1 Build 20260708 Rel.64832, ER7206 v2 to 2.3.5 Build 20260625 Rel.43136, ER707-M2 v1 to 1.4.4 Build 20260625 Rel.43063); firmware is available from https://www.omadanetworks.com/en/support/download/ (or /us/) and the advisory at https://www.tp-link.com/us/support/faq/5256/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all TP-Link Omada ER-series and DR-series VPN routers and verify which are configured as OpenVPN servers; disable OpenVPN functionality on non-essential devices as interim mitigation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Er7212Pc V2
View allCleartext transmission of DDNS authentication credentials in TP-Link Omada business gateway routers exposes sensitive ac
Captive portal session management across multiple TP-Link Omada ER and DR series routers exposes unauthenticated session
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today