G611 Firmware
Monthly
Root shell escape on TP-Link Omada gateways allows an attacker who already holds high-privilege administrative access to the management interface, and who can reach it from an adjacent network, to break out of the restricted management shell and gain root on the underlying OS. Affected firmware includes FR307-M2 1.2.5, FR205 1.0.3, FR365 1.1.10, G611 1.2.2, and G36 1.1.4, with vendor tags also naming Omada ER605, ER706W/4G, ER707-M2, ER7206, ER7212PC, ER7412-M2, and ER8411 gateways. Exploitation is constrained by required admin credentials, adjacent access, high attack complexity, and a prerequisite device condition; no public exploit was identified at time of analysis, and EPSS is 0.67% (51st percentile), indicating low predicted exploitation.
OS command injection in the web management portal of TP-Link Omada gateways (Omada, Omada Pro, and Festa lines) lets an attacker with valid administrator credentials execute arbitrary shell commands on the underlying device, with high confidentiality, integrity, and availability impact to the gateway and limited scope change to connected systems. Exploitation is gated by two prerequisites assessed from the vector: administrator authentication to the portal (PR:H) and adjacent-network reachability to that management interface (AV:A), so internet-exposed management portals are not the expected attack path and no public exploit code was identified at time of analysis. EPSS sits at roughly 3.3% (88th percentile), indicating elevated relative attention versus typical CVEs but not evidence of active exploitation - this CVE is not in CISA KEV.
Unauthenticated OS command injection in TP-Link Omada router firmware lets remote attackers execute arbitrary OS commands on affected ER605, ER7206, ER707-M2, ER7412-M2, ER8411 and other listed models, with high confidentiality, integrity, and availability impact. The CVSS 4.0 vector is 9.3 with AV:N/AC:L/AT:N/PR:N/UI:N, reflecting a network-reachable, low-complexity, unauthenticated attack when the vulnerable management/service interface is reachable. No public exploit code or CISA KEV entry was identified at time of analysis; EPSS is 1.01% (63rd percentile).
Authenticated command injection in TP-Link Omada business and SOHO routers allows a user who can log in to the web management interface to execute arbitrary OS commands on the device, compromising confidentiality, integrity, and availability. The flaw is rated 8.6 with PR:H, so exploitation requires valid privileged management credentials and network reachability to the management plane; risk rises sharply where that interface is exposed to the WAN or protected by default, shared, or weak credentials. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.69% (52nd percentile).
Root shell escape on TP-Link Omada gateways allows an attacker who already holds high-privilege administrative access to the management interface, and who can reach it from an adjacent network, to break out of the restricted management shell and gain root on the underlying OS. Affected firmware includes FR307-M2 1.2.5, FR205 1.0.3, FR365 1.1.10, G611 1.2.2, and G36 1.1.4, with vendor tags also naming Omada ER605, ER706W/4G, ER707-M2, ER7206, ER7212PC, ER7412-M2, and ER8411 gateways. Exploitation is constrained by required admin credentials, adjacent access, high attack complexity, and a prerequisite device condition; no public exploit was identified at time of analysis, and EPSS is 0.67% (51st percentile), indicating low predicted exploitation.
OS command injection in the web management portal of TP-Link Omada gateways (Omada, Omada Pro, and Festa lines) lets an attacker with valid administrator credentials execute arbitrary shell commands on the underlying device, with high confidentiality, integrity, and availability impact to the gateway and limited scope change to connected systems. Exploitation is gated by two prerequisites assessed from the vector: administrator authentication to the portal (PR:H) and adjacent-network reachability to that management interface (AV:A), so internet-exposed management portals are not the expected attack path and no public exploit code was identified at time of analysis. EPSS sits at roughly 3.3% (88th percentile), indicating elevated relative attention versus typical CVEs but not evidence of active exploitation - this CVE is not in CISA KEV.
Unauthenticated OS command injection in TP-Link Omada router firmware lets remote attackers execute arbitrary OS commands on affected ER605, ER7206, ER707-M2, ER7412-M2, ER8411 and other listed models, with high confidentiality, integrity, and availability impact. The CVSS 4.0 vector is 9.3 with AV:N/AC:L/AT:N/PR:N/UI:N, reflecting a network-reachable, low-complexity, unauthenticated attack when the vulnerable management/service interface is reachable. No public exploit code or CISA KEV entry was identified at time of analysis; EPSS is 1.01% (63rd percentile).
Authenticated command injection in TP-Link Omada business and SOHO routers allows a user who can log in to the web management interface to execute arbitrary OS commands on the device, compromising confidentiality, integrity, and availability. The flaw is rated 8.6 with PR:H, so exploitation requires valid privileged management credentials and network reachability to the management plane; risk rises sharply where that interface is exposed to the WAN or protected by default, shared, or weak credentials. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.69% (52nd percentile).