EUVD-2026-63545
GHSA-hgmf-v69c-5gmf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the required on-path MITM network position; C:L and I:L capture credential disclosure and DNS manipulation without broader system compromise.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path.
Successful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment.
AnalysisAI
Cleartext transmission of DDNS authentication credentials in TP-Link Omada business gateway routers exposes sensitive account information to network-positioned attackers. Nineteen distinct hardware models spanning the ER and DR product lines are affected, including the ER605, ER7206, ER8411, and multiple 4G outdoor variants. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) DDNS must be explicitly configured on the affected Omada gateway - the feature is opt-in and not enabled by default, meaning devices with factory or default configurations are not vulnerable; (2) the gateway must be actively communicating with an external DDNS provider, meaning a DDNS update must be in progress or scheduled; and (3) the attacker must have visibility or active control of the network path between the gateway's WAN interface and the DDNS service endpoint - this is the most significant limiting factor, requiring an on-path position (ISP-level access, compromised upstream router, ARP spoofing on the same LAN segment, or large-scale BGP manipulation). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N) scores 6.3 and accurately reflects a moderate-severity issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a man-in-the-middle position between an unpatched Omada gateway and its configured DDNS provider - for example, a malicious actor at the ISP layer, on a shared upstream network segment, or via BGP route hijack - passively captures the plaintext HTTP DDNS update request containing authentication credentials. With those credentials, the attacker authenticates to the DDNS provider's management portal and modifies the DNS A record for the organization's dynamic hostname to redirect traffic to an attacker-controlled server, enabling phishing, credential harvesting, or service impersonation. … |
| Remediation | Patch available per vendor advisory - upgrade affected devices to the firmware versions listed in the affected products section, all released between June 25 and July 23, 2026, and downloadable from https://www.omadanetworks.com/en/support/download/ or https://www.omadanetworks.com/us/support/download/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Er7212Pc V2
View allPre-authentication OS command injection in TP-Link Omada gateways (ER-series and DR-series VPN routers) lets an unauthen
Captive portal session management across multiple TP-Link Omada ER and DR series routers exposes unauthenticated session
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today