Er7206 V2
Monthly
Cleartext transmission of DDNS authentication credentials in TP-Link Omada business gateway routers exposes sensitive account information to network-positioned attackers. Nineteen distinct hardware models spanning the ER and DR product lines are affected, including the ER605, ER7206, ER8411, and multiple 4G outdoor variants. An attacker with visibility or control over the network path between the gateway and an external DDNS provider can intercept credentials and potentially hijack DDNS management - enabling unauthorized DNS record manipulation for the affected deployment. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Pre-authentication OS command injection in TP-Link Omada gateways (ER-series and DR-series VPN routers) lets an unauthenticated remote attacker execute arbitrary commands when the device is configured as an OpenVPN Server, because client-supplied data is insufficiently validated during OpenVPN connection establishment before authentication completes. Successful exploitation can yield full device compromise (CVSS 4.0 9.3, CWE-78). No public exploit has been identified at time of analysis, and the flaw was reported by the vendor (TP-Link) itself.
Captive portal session management across multiple TP-Link Omada ER and DR series routers exposes unauthenticated session-termination functions to any attacker with adjacent network access, allowing forced logout of specific users or full session clearance without credentials. Nineteen hardware models running firmware prior to late June-July 2026 builds are confirmed affected per EUVD data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity combined with zero authentication requirements makes adjacent-network exploitation straightforward once an attacker is positioned on the same network segment as the captive portal service.
Cleartext transmission of DDNS authentication credentials in TP-Link Omada business gateway routers exposes sensitive account information to network-positioned attackers. Nineteen distinct hardware models spanning the ER and DR product lines are affected, including the ER605, ER7206, ER8411, and multiple 4G outdoor variants. An attacker with visibility or control over the network path between the gateway and an external DDNS provider can intercept credentials and potentially hijack DDNS management - enabling unauthorized DNS record manipulation for the affected deployment. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Pre-authentication OS command injection in TP-Link Omada gateways (ER-series and DR-series VPN routers) lets an unauthenticated remote attacker execute arbitrary commands when the device is configured as an OpenVPN Server, because client-supplied data is insufficiently validated during OpenVPN connection establishment before authentication completes. Successful exploitation can yield full device compromise (CVSS 4.0 9.3, CWE-78). No public exploit has been identified at time of analysis, and the flaw was reported by the vendor (TP-Link) itself.
Captive portal session management across multiple TP-Link Omada ER and DR series routers exposes unauthenticated session-termination functions to any attacker with adjacent network access, allowing forced logout of specific users or full session clearance without credentials. Nineteen hardware models running firmware prior to late June-July 2026 builds are confirmed affected per EUVD data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity combined with zero authentication requirements makes adjacent-network exploitation straightforward once an attacker is positioned on the same network segment as the captive portal service.