Tp Link Systems Inc
Monthly
Authentication bypass in the TDDP v2 service of the TP-Link RE305 V3 range extender lets an unauthenticated attacker on the same local network forge protocol packets using a fixed, derivable cryptographic key and reach privileged TDDP operations, including functionality that can result in operating-system command execution with root privileges. Only devices running RE305 V3 firmware before 1.1.8 Build 20260921 Rel. 42853 are affected, and exploitation requires the TDDP service to be running and reachable from the attacker's adjacent network segment (CVSS 4.0 8.7 / assessed CVSS 3.1 8.7, AV:A). A vendor patch is available and no public exploit has been identified at time of analysis; the priority label is this_week because the flaw yields full confidentiality, integrity and availability impact once an attacker has local network presence.
Improper authentication (CWE-287) in TP-Link Tapo C210 V3.60 firmware lets an attacker positioned on the same adjacent network retrieve shared credential material and cryptographic metadata by sending unauthenticated DS JSON API requests to the camera, without any credentials or user interaction. The recovered shared credential is then accepted by the Streamd Digest authentication mechanism as the administrative password, so the attacker can establish encrypted media sessions and view the camera's protected streams without ever knowing the device account password. Impact is confined to confidentiality - high credential/crypto disclosure and unauthorized media-session access - with no integrity or availability effect cited; exploitation requires local LAN/Wi-Fi adjacency and is not reachable directly from the internet, and no public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated stack-based buffer overflow in TP-Link Tapo C320WS V2.0 cameras lets an attacker on the adjacent network who already holds valid device credentials overwrite stack memory through an oversized encrypted password field submitted to the local onboarding Wi-Fi configuration path, ultimately executing commands as root. Because the trigger lives in the provisioning endpoint that is only reachable on the local or onboarding LAN (not from the internet) and requires high-privilege authentication, exploitation is conditionally gated rather than broadly opportunistic; no public exploit code or confirmed active exploitation was identified at time of analysis. Successful abuse lets the attacker take control of the camera, alter its behavior, read sensitive local configuration, and disrupt availability, and TP-Link has published fixed firmware on its download portal.
Improper authentication in the local device-management protocol of TP-Link Kasa smart plugs, switches, dimmers, and bulbs lets an unauthenticated attacker who is already on the same Wi-Fi/LAN segment send management instructions to the device, changing device state and settings or disrupting legitimate user control. The vendor scores this 8.7 (CVSS 4.0 AV:A/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity, and availability impact to the device), and the independent assessment agrees: authentication is not required within the adjacent network (PR:N, CWE-306), but the ADJACENT attack vector confines exploitation to attackers holding a foothold on the local segment rather than the public internet. No public exploit code has been identified at time of analysis, and the described cloud-account information exposure is conditional - it depends on concurrent user, mobile-app, and device-cloud interaction - so full account compromise is not guaranteed.
Predictable pre-shared key generation in the TP-Link Tapo C325WB V2 camera's local media streaming service allows an unauthenticated attacker on the adjacent network to recover the key and authenticate to the stream without credentials. This enables access and takeover of live video and audio feeds, compromising confidentiality and integrity. The vulnerability is rated 8.7 (High) with no public exploit identified at time of analysis; a vendor firmware patch is available.
TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass in its HTTPS JSON API dispatcher that allows an attacker on the adjacent network to append an onboarding-scoped object to a JSON request and thereby skip session verification, invoking privileged actions without credentials. Successful exploitation can expose live video and audio, modify device settings, and disclose sensitive device information or secrets. The vendor has released patched firmware, no public exploit code was identified at time of analysis, and independent assessment rates the issue high severity under CVSS 3.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with the adjacent-network requirement the primary limiting factor.
Unauthenticated denial of service in the TP-Link Tapo C325WB v2 camera allows a crafted pair of RTSP-over-HTTP tunneling requests sent to the streaming service on TCP port 554 to corrupt memory (stack-based buffer overflow, CWE-121) and crash the streaming daemon, disrupting live video and related streaming functions until the daemon recovers or restarts. Only cameras with the optional Camera Account feature enabled are exposed, and the attacker must be positioned on the same adjacent network segment (Wi-Fi or LAN) as the camera, since the assessed vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; no authentication or user interaction is required. Impact is availability-only and temporary, no public exploit identified at time of analysis, and a vendor patch is available per the TP-Link firmware release notes and advisory FAQ 5333.
Unauthenticated attackers with adjacent-network access can crash the TDP daemon on TP-Link Tapo C500 v2.0 cameras by sending a single crafted UDP datagram, causing a denial-of-service condition. The flaw is an out-of-bounds function-pointer dispatch (CWE-823) that triggers an invalid indirect call, and the CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) plus our independent CVSS 3.1 assessment (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirm only availability is impacted-no data disclosure or code execution. No public exploit code or active exploitation is identified in the provided data, but the vendor has released a patch; the attack requires Layer-2 adjacency and no authentication, session, or pairing.
Command injection in the TDDPv2 service (/usr/bin/tddp) on TP-Link Archer AX90 V1 routers allows an unauthenticated attacker who is already positioned on the same adjacent network layer - wired LAN, Wi-Fi, or guest network - to inject operating system commands through the setProductVer command handler, which then run as root. The injected payload is executed during device boot, so the attacker must wait for or induce a reboot, and the device is not exploitable over the internet; a fixed firmware release is available from the vendor. Analysis found no public exploit code (no public exploit identified at time of analysis) and the issue is not in CISA KEV, so this is assessed as a credible but above-average-priority fleet risk rather than an internet-wide emergency.
Stack-based buffer overflow in the TDDPv2 service (/usr/bin/tddp) on TP-Link Deco M9 Plus v2 mesh units lets a network-adjacent, unauthenticated attacker crash the device or potentially execute arbitrary code, but only while the unit is in its setup/provisioning phase. A crafted TDDP request whose decrypted payload is longer than the fixed-size stack buffer used by the subtype 0x91 handler (CWE-121) triggers the overflow with no user interaction. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; TP-Link has published fixed firmware. The risk is genuine but conditionally gated: the attacker must already sit on the same Wi-Fi/link-local segment during onboarding, which substantially narrows realistic exposure.
Command execution and administrative-session bypass in TP-Link Tapo C120 v1 and C200 V5 cameras let an unauthenticated attacker on the same local network replay login challenge data, enable a privileged service that becomes reachable after reboot, and inject commands via the MacTool handler. The vendor reports a patch is available, and no public exploit code or CISA KEV active-exploitation entry was identified at time of analysis. Our independent assessment rates this as a credible, above-average-priority issue but not a drop-everything emergency because the attack requires same-LAN access, successful challenge replay, service activation, and a reboot.
Denial of service in TP-Link Tapo C120 v1 and C200 v5 cameras allows an unauthenticated attacker on an adjacent network segment to overwrite the device's wireless onboarding parameters and force it to join a different network, after which the camera becomes unreachable at its management address. The root cause is a missing-authentication condition (CWE-306) in the HTTPS onboarding 'do' method connect actions that persists after initial setup, so no credentials and no user interaction are required, although exploitation is limited to attackers on the same local or wireless segment and the outcome is availability-only with no confidentiality or integrity impact. No public exploit identified at time of analysis, and a vendor firmware update addressing the issue is available per TP-Link's advisory and download pages.
Denial of service affecting TP-Link Tapo C120 v1 and C200 v5 security cameras, where a malformed HTTPS onboarding connect request that omits the password field for certain authentication and encryption parameter combinations triggers a NULL pointer dereference (CWE-476) in the request parser and crashes the HTTPS management service. The endpoint is reachable without authentication once the device has completed initial setup, but attackers must already sit on the same local network segment (CVSS 4.0 vector AV:A/PR:N, assessed equivalent CVSS 3.1 AV:A/AC:L/PR:N/UI:N with availability-only impact), so internet-facing exposure is not the default scenario. Impact is confined to temporary loss of HTTPS management functions, with sustained outages requiring repeated malformed requests and some cases necessitating a manual device reboot; no public exploit code was identified at time of analysis and no CISA KEV entry exists, and the vendor has published firmware release notes addressing the flaw.
OS command injection in TP-Link Deco BE11000 V2's TDDP (TP-Link Device Debug Protocol) module enables unauthenticated adjacent-network attackers to execute arbitrary commands with root privileges by sending a single crafted UDP packet. The vulnerability results in complete device compromise, covering unauthorized command execution, configuration modification, and total loss of confidentiality, integrity, and availability. A vendor firmware patch is available via the TP-Link support page; no public exploit has been identified at time of analysis.
Stack-based buffer overflow in the EasyMesh daemon of the TP-Link Archer AX55 v4 allows a LAN-adjacent unauthenticated attacker to crash the easymesh process and potentially achieve remote code execution on the router, provided Mesh mode is enabled. The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N) correctly constrains the attack to the local network segment with high complexity due to the Mesh mode prerequisite. TP-Link has released a patched firmware; no public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in TP-Link TL-MR100 V3.20 allows an adjacent unauthenticated attacker to corrupt the httpd process stack by sending a crafted encrypted payload to the /cgi/login endpoint before any authentication occurs. The flaw resides in the http_gdpr_decrypt function, which performs insufficient bounds checking on incoming data, enabling overwrite of saved control-flow data and potential arbitrary code execution in the context of the httpd process. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized device control of TP-Link Kasa smart home devices is achievable by any attacker with local network adjacency, due to missing required cryptographic protections (CWE-325) in the local LAN communication protocol. At least 20 distinct Kasa product models are affected, spanning smart plugs, power strips, outdoor outlets, and in-wall switches. Exploitation enables interception, replay, and forgery of device control messages with no authentication required, allowing complete operational manipulation or denial-of-service of affected hardware.
Stored OS command injection in the TP-Link Archer BE3600 V1 parent-control module allows an authenticated administrative attacker on the adjacent network to achieve arbitrary command execution on the device. The payload is persisted at configuration time-embedded in a crafted profile name-and fires asynchronously when the router's daily cloud report generation job runs, without any further attacker interaction. A vendor-released patch is available from TP-Link; no public exploit has been identified at time of analysis.
Root-level command injection in the TP-Link Archer BE800 V1 router (firmware prior to 1.4.2 Build 260708) allows an authenticated administrator on an adjacent network to execute arbitrary OS commands with root privileges by injecting shell metacharacters through the VPN connection interface. Successful exploitation hands an attacker full control of the embedded Linux environment, enabling persistent backdoors, credential theft, and use of the router as a pivot into the connected LAN. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released firmware patch is available.
Unauthenticated OS command injection in TP-Link Archer BE800 V1, BE3600 V1, and AX75 V1 routers allows any LAN-adjacent attacker to execute arbitrary commands with root privileges via the parental control subsystem. Exploitation requires no credentials and no user interaction, resulting in complete device compromise including full control over routing, firewall policy, and all traffic transiting the device. Vendor-released firmware patches are available for all three affected models; no public exploit code or CISA KEV listing has been identified at time of analysis.
Hard-coded RSA-512 mesh group private key in TP-Link Deco XE75 v3, XE5300 v3.6, and WE10800 v3.6 firmware allows an adjacent attacker to impersonate a trusted mesh node without possessing any device-specific credential. Because the same private key is shared across all affected devices and embedded in firmware images that TP-Link publishes publicly on its download portal, the barrier to key extraction is low. No public exploit or active exploitation has been identified at time of analysis, but a vendor-released patch is available.
Stack-based out-of-bounds write in the TP-Link TL-MR6400 v7 administrative web interface login handler allows an unauthenticated attacker with adjacent network access to crash the web management service by sending a specially crafted malformed HTTP request. The vulnerability (CWE-787) is confined to the login request parsing path and requires no authentication or user interaction, though exploitation is bounded by the adjacent network attack vector. Impact is limited to a denial-of-service condition - temporary loss of management interface access - with no confirmed confidentiality or integrity impact; no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
NULL pointer dereference in TP-Link TL-MR6400 v7's HTTP request parsing crashes the management daemon when an unauthenticated adjacent-network attacker sends a specially crafted request containing a malformed session cookie header. Successful exploitation results in a denial-of-service condition, disabling the web management interface and CGI functionality until service recovery - no confidentiality or integrity compromise is possible. No active exploitation has been confirmed (not in CISA KEV), no public proof-of-concept code has been reported, and a vendor patch is available.
Stack-based buffer overflow in TP-Link TL-MR6400 v7 firmware update functionality enables an authenticated, adjacent-network attacker to achieve arbitrary code execution on the affected device. The flaw (CWE-121) arises from unsafe parsing of attacker-controlled metadata embedded in a firmware image, leading to memory corruption at the stack level. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is further constrained by requirements for high-privilege access (PR:H) and network adjacency (AV:A).
Pre-authentication OS command injection in TP-Link Omada gateways (ER-series and DR-series VPN routers) lets an unauthenticated remote attacker execute arbitrary commands when the device is configured as an OpenVPN Server, because client-supplied data is insufficiently validated during OpenVPN connection establishment before authentication completes. Successful exploitation can yield full device compromise (CVSS 4.0 9.3, CWE-78). No public exploit has been identified at time of analysis, and the flaw was reported by the vendor (TP-Link) itself.
OS command injection in the TP-Link Archer C20 v6 web management interface enables an authenticated administrator to execute arbitrary system commands by submitting crafted WAN configuration inputs that bypass insufficient input validation. Full device compromise - confidentiality, integrity, and availability - is achievable for all traffic routed through the affected device. TP-Link has released a patched firmware; no public exploit code or CISA KEV listing has been identified at time of analysis.
Null pointer dereference in the RTSP service of TP-Link Tapo C100 V5 and C101 V5 IP cameras allows an unauthenticated attacker on the same local network segment to crash the video streaming service and trigger a full device reboot. The flaw is rooted in improper pointer validation during RTSP request parsing (CWE-476), with impact limited strictly to availability - no data exfiltration or configuration tampering is possible. A vendor-released firmware patch is available; no public exploit code or CISA KEV listing has been identified at the time of analysis.
Buffer overflow in the TP-Link Tapo P110 v1 smart plug's HTTP request handling allows an adjacent-network attacker to crash the web service process, resulting in a denial-of-service condition. The device's web service performs a memory copy of HTTP request body data without validating input length against the destination buffer, enabling an oversized payload to corrupt adjacent memory regions. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released firmware patch is available via the TP-Link download portal.
OS command injection in the VPN module of TP-Link Archer AXE75 V1 routers allows an adjacent, authenticated attacker with administrator-level access to achieve full device compromise by importing a specially crafted VPN client configuration file. Improper filtering of special characters (CWE-78) in configuration input permits injection of arbitrary OS commands, granting an attacker complete control over the device including configuration integrity, network routing, and service availability. No public exploit identified at time of analysis; vendor-released patch is available.
Remote code execution and denial-of-service in the TP-Link TL-WR940N v6 router stem from a stack-based buffer overflow in the kernel-resident RTSP connection-tracking (ALG) module. An attacker who lures a LAN-side client into connecting to an attacker-controlled RTSP server can send a crafted RTSP message that the router's kernel helper mishandles, potentially yielding full device compromise. The flaw is exploitable by an unauthenticated attacker against the router's default configuration; no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Use of a hard-coded, device-shared cryptographic private key in TP-Link Kasa EC71 v4 and EC70 v4 camera firmware lets an adjacent-network attacker impersonate the device's web management service and break its transport encryption. Because the same private key is baked into every unit's read-only filesystem, anyone who extracts it from one firmware image can passively decrypt or actively man-in-the-middle traffic to any other device on the local network without authentication. TP-Link (the reporting vendor) has released fixed firmware; there is no public exploit identified at time of analysis and the CVE is not in CISA KEV.
Credential disclosure in TP-Link Deco M5 v1 mesh routers stems from a weak (computationally cheap) password-hashing scheme used to store local user credentials, letting an attacker who has already obtained the stored hash recover the plaintext password via offline brute-force or dictionary attacks. Affected devices are the Deco M5 v1 hardware revision, and successful cracking yields access to device management functions scoped to the recovered account's privileges. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the CVSS 4.0 vector (AV:L/AC:H/PR:H) reflects that it is a post-compromise credential-recovery weakness rather than a remote entry point.
OS command injection in the TP-Link Archer VX1800v (v1) router lets an adjacent, high-privileged attacker inject shell metacharacters through the domain name parameter of an HTTP management interface, yielding arbitrary command execution as root and full device takeover. The flaw scores CVSS 4.0 8.5 (High) and a vendor firmware patch is available; no public exploit identified at time of analysis. Note a naming discrepancy in the source data - the free-text description says 'VX800v' while the CPE and tags reference 'VX1800V' - so verify the exact affected model against the TP-Link advisory before acting.
Root-level OS command injection in the TR-069/CWMP management client of the TP-Link Archer VX1800v v1 gateway lets an attacker who controls (or has compromised) the ACS provisioning server inject unsanitized parameters that the device executes as system-level commands. Because CWMP provisioning is trusted implicitly, a malicious or hijacked ACS can push crafted values that yield arbitrary command execution as root and full device takeover. No public exploit identified at time of analysis, and the flaw was reported by TP-Link itself; a firmware fix is available.
Remote denial-of-service in the TP-Link Tapo C200 v3 home security camera allows an unauthenticated attacker on the adjacent network to crash or destabilize the device by sending malformed IPv4 fragmented packets. Exploitation drives excessive resource consumption (CWE-770) and renders the camera unresponsive, causing intermittent loss of live video monitoring and recording. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; TP-Link, who reported it, has released a firmware fix.
Command injection in TP-Link Archer and TL-MR series routers allows an adjacent unauthenticated attacker on the same broadcast domain to execute arbitrary commands with elevated privileges by supplying crafted DHCP option responses. The flaw resides in DHCP client option processing during device initialization and is most reliably triggered when the router is in factory-default or unconfigured state. No public exploit identified at time of analysis, but the vendor (TP-Link) has confirmed the issue and released firmware patches.
Authenticated OS command injection in the TP-Link TL-WR940N v6 router's IPv6 PPPoE configuration handler allows administrators to break out of the configuration parser and execute arbitrary shell commands with elevated (typically root) privileges on the device. The flaw was reported by TP-Link itself and a firmware fix is available; no public exploit identified at time of analysis. Risk is bounded by the CVSS 4.0 vector requiring adjacent-network access and high privileges (AV:A/PR:H), but post-exploitation impact on confidentiality, integrity, and availability is rated High.
Authenticated OS command injection in the TP-Link TL-WR940N v6 router's BigPond Cable (BPA) WAN configuration module allows administrators to execute arbitrary system commands with elevated privileges on the device. The flaw stems from improper sanitization of user-supplied input in the WAN setup path and affects firmware versions prior to V6_260528. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated format string vulnerability in the ONVIF service of TP-Link Tapo C110 v2 cameras allows adjacent-network attackers with valid credentials to manipulate stack memory and redirect execution to internal functions, triggering an unauthorized factory reset. Successful exploitation wipes configuration, deletes stored credentials, and disrupts video surveillance service. No public exploit identified at time of analysis, and the issue is not on CISA KEV.
OS command injection in the VPN module of TP-Link Archer AX12 v1, AX17 v1, AX18 v1, and AX1300 v1.6 routers allows an authenticated attacker on an adjacent network to execute arbitrary commands by uploading a malicious VPN client configuration file. The flaw stems from improper sanitization of special characters during configuration import (CWE-78) and carries a CVSS 4.0 base score of 8.5. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV, but TP-Link has released firmware fixes for all affected models.
Authenticated command injection in the TP-Link Archer MR600 v5 router allows administrators on the adjacent network to execute arbitrary OS commands via the WireGuard client configuration in the web management interface. The flaw stems from improper neutralization of user-controlled input when configuration changes are applied, enabling full device compromise. No public exploit identified at time of analysis, but TP-Link has released a firmware patch.
Authorization bypass in TP-Link Tapo C520WS v2 cameras allows holders of restricted accounts (such as hub users) to execute privileged operations they are not entitled to perform. By abusing the device API's legitimate method mapping behavior, an authenticated low-privilege attacker on the adjacent network can disguise sensitive calls as whitelisted ones, leading to integrity loss and high availability impact including device resets and configuration changes. No public exploit identified at time of analysis, and the issue was reported by TP-Link itself with a vendor patch available.
Denial of service in the RTSP server of TP-Link Tapo C520WS v2 IP cameras allows adjacent network attackers to render the camera's video streaming service non-responsive by sending syntactically invalid RTSP input. The flaw is reachable without authentication or user interaction from the local network segment (CVSS 4.0 vector AV:A/PR:N/UI:N) and no public exploit identified at time of analysis. While confidentiality and integrity are unaffected, availability of the surveillance stream is fully impacted, which is operationally significant for a security camera.
Denial of service in TP-Link Tapo C200 v5 IP cameras allows adjacent network attackers to crash the RTSP service and force a device reboot by sending a crafted Authorization header in an RTSP authentication request. The flaw is a stack-based buffer overflow (CWE-121) in the RTSP authentication handler; no public exploit identified at time of analysis, but vendor-acknowledged and patched firmware is available from TP-Link.
Cleartext Bluetooth transmission in TP-Link Tapo L535E, P300, and D100C devices allows adjacent attackers to intercept and manipulate initial setup data, enabling potential unauthorized device control during onboarding. The flaw stems from missing encryption on the Bluetooth pairing channel used only during initialization, and TP-Link has released patched firmware versions for all affected models. No public exploit identified at time of analysis, but the low complexity and absence of authentication make this a meaningful risk for users provisioning devices in dense urban or office environments.
Credential brute-forcing against TP-Link Archer C64 v1 routers is possible via an undocumented debug SSH service that shares credentials with the web admin interface but enforces no authentication rate-limiting. Adjacent attackers (same Wi-Fi or LAN segment) can iterate password guesses without lockout to recover the administrator password and take full control of the router. No public exploit identified at time of analysis; CVSS 4.0 base score is 8.7 (High) and a vendor patch is available.
Administrative password reset in multiple TP-Link Wi-Fi range extenders (Archer RE650/RE305/RE360 v1, TL-WA860RE v4, RE580D v1) lets an unauthenticated attacker on the adjacent wireless/LAN network tamper with a login parameter to bypass authentication and take over the device. The flaw stems from insufficient validation of a client-supplied login parameter, yielding full admin control with no credentials or user interaction. There is no public exploit identified at time of analysis and EPSS is low (0.10%), but the vendor has released patched firmware.
OS command injection in TP-Link Archer AX53 v1.0 dnsmasq module allows authenticated adjacent attackers to execute arbitrary code through maliciously crafted configuration files. Successful exploitation enables device configuration modification, sensitive data access, and complete system compromise. Affects TP-Link Archer AX53 v1.0 firmware versions prior to 1.7.1 Build 20260213. Requires high-privilege adjacent network access (CVSS:4.0 AV:A/PR:H). No public exploit identified at time of analysis.
OS command injection in TP-Link Archer AX53 v1.0 OpenVPN module allows authenticated adjacent attackers to execute arbitrary system commands through maliciously crafted configuration files. Exploitation requires high-privilege adjacency access but enables complete device compromise including configuration modification, credential disclosure, and persistent backdoor installation. Affects AX53 v1.0 firmware prior to 1.7.1 Build 20260213. No public exploit identified at time of analysis.
Stack-based buffer overflow in TP-Link Archer AX53 v1.0 tmpServer module enables authenticated adjacent attackers to execute arbitrary code via malicious configuration file. Exploitation triggers segmentation fault, permits device state modification, sensitive data exposure, and integrity compromise. Affects firmware versions before 1.7.1 Build 20260213. Requires high privileges and adjacent network access. No public exploit identified at time of analysis.
Denial-of-service vulnerability in TP-Link Tapo C520WS v2.6 camera allows adjacent network attackers to trigger buffer overflow through crafted HTTP requests with excessively long paths that bypass initial length validation during path normalization, resulting in memory corruption and device reboot without requiring authentication. Vendor has released a patch; no public exploit code identified at time of analysis.
Stack-based buffer overflow in TP-Link Tapo C520WS v2.6 allows remote attackers to trigger denial-of-service by sending oversized configuration parameters to a vulnerable configuration handling component. Successful exploitation causes device crash or reboot, impacting camera availability. Vendor has released a patch.
TP-Link Tapo C520WS v2.6 contains an authentication bypass in its HTTP-based DS configuration service that allows unauthenticated attackers to execute privileged device configuration actions by appending authentication-exempt parameters to requests. The vulnerability stems from inconsistent JSON request parsing and authorization logic, enabling unauthorized modification of device state without requiring valid credentials. No public exploit code has been identified at time of analysis, and a vendor-released patch is available.
Heap-based buffer overflow in TP-Link Tapo C520WS v2.6 allows local network attackers to cause denial of service by sending crafted payloads during asynchronous video stream processing, triggering memory corruption and process crashes. The vulnerability stems from insufficient buffer boundary validation in streaming input handling. A vendor patch is available.
Heap-based buffer overflow in TP-Link Tapo C520WS v2.6 allows unauthenticated network attackers to trigger denial-of-service by sending crafted HTTP payloads that bypass boundary validation during segmented request body parsing. The vulnerability exploits insufficient write-boundary verification in the HTTP parsing loop, causing heap memory corruption that crashes or hangs the device process. Patch is available from the vendor.
Heap-based buffer overflow in TP-Link Tapo C520WS v2.6 allows remote attackers on the same network segment to trigger denial-of-service by sending crafted HTTP POST payloads that exceed allocated buffer boundaries. The vulnerability stems from missing validation in HTTP body parsing logic, causing process crashes or unresponsiveness. No CVSS score or vector data is available, limiting precise severity quantification, but the practical attack vector is network-adjacent and does not require authentication.
An out-of-bounds read vulnerability in the UPnP service of TP-Link TL-WR841N v14 routers enables adjacent network attackers to crash the UPnP daemon without authentication, resulting in denial of service. Affected devices include firmware versions prior to EN_0.9.1 4.19 Build 260303 and US_0.9.1.4.19 Build 260312. Vendor patches are available. No public exploit identified at time of analysis, with CVSS:4.0 scoring 7.1 (High) reflecting adjacent network access requirements and high availability impact.
Authenticated attackers can achieve root-level command execution on TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 routers by uploading a malicious configuration file through the import function, exploiting improper input validation in the port-trigger processing logic. Successful exploitation grants complete control over the affected device, allowing full compromise of the router and any connected network. A patch is available for this high-severity vulnerability.
Unauthenticated attackers can trigger out-of-bounds memory access in the web interface of multiple Omada switches through improper input validation, potentially achieving remote code execution or causing denial-of-service. Affected products include Sg2005p PD 1.x, Sg2008 4.2x/4.3x, and Sg2008p 3.2x/3.3x, which require only network access to the vulnerable interface. A patch is available to address this high-severity vulnerability (CVSS 7.7).
The country/region configuration interface of the TP-Link RE305 V3 range extender lacks an authorization check, so anyone who can reach it from the same local network - joined to its Wi-Fi or on the same LAN - can rewrite the wireless regulatory region and force the device to reapply its wireless configuration, with no credentials or user interaction needed. The practical result is limited to wireless availability: interrupted connections, unavailable channels, client disconnections and unstable service, plus operating parameters meant for a different regulatory domain; there is no loss of confidentiality or of device-data integrity. Exploitation is constrained to the adjacent network segment rather than the internet, so exposure depends on who can join that local wireless or wired network. No public exploit code was identified at time of analysis, and TP-Link has released fixed firmware.
OS command injection in the tmpServer/TDDPv1 service of the TP-Link RE305 V3 range extender lets a low-privileged local attacker run arbitrary operating-system commands as root on the device. The service listens only on the local loopback interface, so the attacker must already hold some on-device execution foothold; there is no network-reachable path and no scope change beyond the extender itself. No public exploit code was identified at time of analysis, and TP-Link has released firmware 1.1.8 Build 20260921 Rel. 42853 that removes the flaw, making this a moderate, situational priority (patching this month) rather than an emergency.
Administrator account takeover in TP-Link RE305 V3 Wi-Fi range extenders: the device's unauthenticated password-recovery verification-code interface can be driven by anyone positioned on the same LAN or Wi-Fi to generate an administrator password-reset code, and the code can then be obtained or brute-forced. Two weaknesses enable this - the interface has no effective attempt counter or lockout, and the verification code is produced by a predictable generation process (CWE-338). Exploitation requires an adjacent-network position (the vector is AV:A, so this is not reachable from the internet) and a brute-force or prediction effort (AC:H); no public exploit or PoC has been identified at time of analysis and the CVE is not in CISA KEV. Successful abuse lets the attacker reset the admin password and reach privileged device-management functions, with high integrity impact but limited confidentiality and availability impact.
Hard-coded AES-128 key and IV values in TP-Link RE305 V3 and Archer C7 V5 configuration backups allow anyone who obtains an exported backup file to decrypt it and recover administrator passwords and Wi-Fi credentials. Affected firmware is RE305 V3 before 1.1.8 Build 20260921 Rel. 42853 and Archer C7 V5 before 1.3.1 Build 20260821 Rel. 41256; exploitation requires possession of a backup file and has no remote path against a running device (CVSS 4.0 base 6.9, local vector). Vendor patches are available, and no public exploit was identified in the supplied intelligence at time of analysis.
Information disclosure in TP-Link Deco BE63 v2.0 lets an attacker who already holds administrative privileges on the device, and can reach it from an adjacent LAN or Wi-Fi segment, query the cloud-client daemon and recover the linked TP-Link ID account password in plaintext. That credential could then be used to access the associated TP-Link cloud account and perform actions as the affected user. The vendor has released a firmware update, and no public exploit was identified at time of analysis; the independent assessment rates this as a constrained medium-severity risk because exploitation requires admin access and adjacent-network positioning.
TP-Link Archer C6 V2 routers use a device-universal hardcoded cryptographic key to protect exported configuration backups and stored credential data, so anyone who obtains such an encrypted artifact can decrypt it and recover plaintext administrative credentials. This is a moderate-severity confidentiality issue (CVSS 4.0 base 5.9; assessed CVSS 3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) because exploitation requires possession of the encrypted configuration file-typically after an administrative export, backup leak, support/RMA exposure, or prior compromise-rather than direct remote decryption. No public exploit has been identified at time of analysis, and TP-Link has released updated firmware for Archer C6 V2.
Authentication bypass in the TP-Link Tapo C210 V3.60 DS JSON API allows attackers on the adjacent network to execute protected camera operations, including pan-tilt-zoom (PTZ) control, without a valid authenticated session. The flaw is rated moderate severity (CVSS 5.3; CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) because exploitation is confined to the same LAN/Wi-Fi segment and the impact is limited to camera functionality manipulation rather than full device takeover. No public exploit code was identified at time of analysis, and CISA KEV status does not indicate active exploitation; TP-Link has released patched firmware.
TP-Link Tapo C500 v2.0 cameras with the ONVIF PTZ interface enabled are vulnerable to an out-of-bounds stack write (CWE-121) that can be triggered by an authenticated ONVIF client sending an excessive number of preset-related elements to the PTZ SOAP handlers, resulting in a service crash and denial-of-service. Exploitation requires valid ONVIF credentials and adjacency to the camera's network (CVSS 4.0: 6.8, AV:A/PR:H), and while the attacker cannot execute code or access data, repeated crashes can disrupt camera management and PTZ functionality until the service restarts. TP-Link has released a firmware patch, and no public exploit code has been identified at time of analysis.
Physical attackers who can obtain, disassemble and hardware-modify a TP-Link Kasa EC70 v4 or EC71 v4 smart plug can restore the manufacturing-severed debug traces, interrupt the boot process and manipulate boot parameters to reach a non-standard initialization path that spawns an unauthenticated root shell during startup, giving full root-level control over the device (high confidentiality, integrity and availability impact to the device itself). The root cause is improper access control on the on-chip debug interface (CWE-1191): the production debug interface is not logically disabled at the firmware or chip level and the bootloader is not locked, so the physical cut of the debug traces is the only barrier. The attacker path is purely physical (CVSS 4.0 AV:P/AC:L/AT:P, assessed as CVSS 3.1 AV:P/AC:H), with no remote or over-the-air vector, and exploitation demands disassembly, trace rework (resoldering/bridging) and boot-timing manipulation; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, while vendor firmware updates are available per the TP-Link release notes.
Unauthenticated devices on the same local network segment as a TP-Link Tapo C120 v1 or Tapo C200 V5 camera can invoke the HTTPS onboarding scan function and pull back metadata about nearby wireless access points, including SSIDs, BSSIDs, authentication and encryption modes, and signal-strength readings (CWE-306, missing authentication for a critical function). The flaw is only reachable after the camera has completed initial setup and requires the attacker to already have adjacent-network access (CVSS:4.0 AV:A/PR:N/UI:N, base 5.3; our own assessment scores it CVSS:3.1 3.1 AV:A/AC:L/PR:N/UI:N with C:L only), so it is not internet-exploitable and yields reconnaissance-grade wireless topology data rather than code execution, credential theft, or camera/video access. There is no KEV listing and no public exploit identified at time of analysis, and TP-Link has published firmware updates for both hardware revisions. This is a genuine but low-to-moderate priority issue, not a critical one, and the practical risk depends entirely on how hostile or shared the camera's LAN/Wi-Fi segment is.
XML External Entity (XXE) injection in TP-Link Omada Controller's SAML SSO metadata parsing allows an authenticated user with SAML configuration privileges to read arbitrary files from the server, resulting in high-confidentiality information disclosure. The vulnerability arises because the controller does not disable external entity resolution when parsing user-supplied SAML metadata XML, enabling server-side file exfiltration. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available.
Authenticated path traversal in the file upload functionality of TP-Link Archer MR600 (v2, v3, v5) and TL-MR6400 v8 allows an admin-level remote attacker to write files outside the intended upload directory, potentially overwriting system files accessible to the affected service. The vendor explicitly states that arbitrary code execution has not been demonstrated, making this an integrity-limited vulnerability rather than a full RCE. Vendor-released firmware patches are available for both affected product lines. No public exploit has been identified at time of analysis.
Missing authentication in VPN configuration management on TP-Link 4G LTE routers (Archer MR600 v2/v3/v5 and TL-MR6400 v8) permits an unauthenticated adjacent-network attacker to read and overwrite VPN credentials and tunnel configuration without any valid credentials. The vendor's CVSS 4.0 vector (AV:A) indicates the attack surface is adjacent-network rather than fully internet-routable, constraining exposure to attackers with local LAN, Wi-Fi, or cellular-segment access. No public exploit has been identified at time of analysis; a vendor-released patch is available via firmware update.
Hard-coded RSA private key exposure in the TP-Link Archer AX55 v4 web module allows a LAN-adjacent attacker who captures HTTP login traffic to decrypt the administrator password, since the shared private key is identical across all units of this model and the AES session key is additionally weakened. All Archer AX55 v4 firmware versions appear affected per the CPE wildcard, with a vendor patch now available via TP-Link's firmware portal. No public exploit code has been identified at time of analysis, though the cryptographic flaw is deterministic - once the static key is extracted from firmware, any captured login session can be decrypted offline.
Cleartext transmission of DDNS authentication credentials in TP-Link Omada business gateway routers exposes sensitive account information to network-positioned attackers. Nineteen distinct hardware models spanning the ER and DR product lines are affected, including the ER605, ER7206, ER8411, and multiple 4G outdoor variants. An attacker with visibility or control over the network path between the gateway and an external DDNS provider can intercept credentials and potentially hijack DDNS management - enabling unauthorized DNS record manipulation for the affected deployment. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Captive portal session management across multiple TP-Link Omada ER and DR series routers exposes unauthenticated session-termination functions to any attacker with adjacent network access, allowing forced logout of specific users or full session clearance without credentials. Nineteen hardware models running firmware prior to late June-July 2026 builds are confirmed affected per EUVD data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity combined with zero authentication requirements makes adjacent-network exploitation straightforward once an attacker is positioned on the same network segment as the captive portal service.
Heap-based buffer overflow in the RTSP service of TP-Link Tapo C100 and C101 V5 IP cameras allows an authenticated attacker on the same local network segment to crash the RTSP service and force a device reboot by sending specially crafted frames with oversized length values. Impact is limited to temporary denial-of-service; no confidentiality or integrity compromise is achievable. No public exploit code has been identified at time of analysis, and TP-Link has released firmware patches for affected devices.
Improper origin validation in the TP-Link TL-WR820N V2 router's web management interface allows adjacent unauthenticated attackers to extract device configuration details and sensitive information by sending HTTP requests with an absent or empty Referer header. The router relies on the HTTP Referer header as a request legitimacy check, but fails to enforce its presence or value consistently, allowing the validation to be trivially bypassed. No public exploit or active exploitation has been identified at time of analysis, though the attack requires only network adjacency and no credentials.
OS command injection in TP-Link Aginet home networking devices (HB, EB, EX, XX, VX series) allows an authenticated attacker on the same network segment to execute arbitrary operating system commands with elevated privileges through unsanitized web interface inputs. The attack vector is adjacent-network only (AV:A per CVSS 4.0), limiting internet-scale exploitation, but a compromised or malicious LAN/Wi-Fi client could fully compromise the affected device. No public exploit code or CISA KEV listing has been identified at time of analysis; TP-Link has released patched firmware across all affected product lines.
Symlink traversal in TP-Link Aginet home networking devices exposes sensitive filesystem files to any attacker who can physically insert a prepared USB storage device. The firmware resolves symbolic links placed on external USB media without validating that the resolved path remains within the intended storage boundary, enabling unauthorized read access to device-internal files such as configuration and credential stores. No public exploit or CISA KEV listing exists at time of analysis; however, the vendor has confirmed patches for all affected models.
Hardcoded cryptographic keys embedded in TP-Link Aginet firmware expose sensitive configuration data to any attacker who gains access to device storage. Affecting over 70 distinct hardware SKUs across the HB, HX, HC, EB, EC, EX, XX, XC, and VX product families, the static keys are identical across all devices sharing a firmware image, meaning key material extracted from one device - or from a publicly downloadable firmware image - decrypts configuration stores on any other device of the same model. Successful exploitation yields plaintext credentials and service configuration, and no public exploit has been identified at time of analysis. TP-Link has released patched firmware for all affected models.
Privilege escalation across more than 60 TP-Link Aginet mesh networking device models allows authenticated low-privileged users to invoke administrative operations - including creating privileged accounts and modifying critical configuration settings - by exploiting insufficient authorization validation (CWE-863). The flaw spans the HB, HX, EX, HC, EB, XX, VX, and XC device families in US, EU, BR, AU, CA, KR, DE, and RU regional variants, with specific vulnerable firmware builds documented per device in ENISA EUVD-2025-210674. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available at the TP-Link advisory.
Authentication bypass in TP-Link Aginet home mesh networking devices allows an adjacent-network attacker without credentials to invoke privileged management operations and gain full administrative control of the device. The flaw (CWE-862, Missing Authorization) stems from inconsistent enforcement of access control checks on specific web management interface endpoints - certain privileged API handlers accept and act on requests without verifying caller identity. The vulnerability affects over 60 distinct model/region/hardware-revision combinations across the HB, HX, EX, HC, VX, and XX Aginet product lines; no public exploit code or CISA KEV listing is identified at time of analysis, but the vendor has released firmware patches.
Arbitrary file write via Zip Slip path traversal in TP-Link's WebUI ISP Upgrade functionality affects three LTE router models - TL-MR6400 v5.3, Archer MR600 v2, and Archer MR200 v7. An authenticated administrator on the adjacent network can upload a crafted archive containing directory traversal sequences (e.g., '../../') to overwrite arbitrary files on the underlying system, compromising integrity and potentially availability. No public exploit code or CISA KEV listing has been identified; vendor-released patches are available as of mid-2026.
Denial-of-service in the TP-Link Archer A6 V4 router's embedded web server allows an authenticated, adjacent-network attacker to crash the httpd process or the device by sending a malformed request to the HTTP-WRITEOEM handler, which fails to validate input before passing it to flash-write logic. All Archer A6 V4 firmware versions prior to V4_1.15.10 Build 260625 Rel.25447 are affected, per EUVD-2026-54656 and TP-Link's own advisory. No public exploit code or active exploitation has been identified at time of analysis.
Denial-of-service in the TP-Link Archer A6 v4 httpd service allows an adjacent, authenticated attacker to crash the web management process or force a device reboot by exploiting a race condition in the asynchronous systool instruction handling path. All firmware builds prior to V4_1.15.10 Build 260625 Rel.25447 are affected; a vendor-released patch has been issued. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog - real-world risk is constrained by the adjacent network and high-privilege prerequisites.
Credential recovery is possible on TP-Link Omada network devices - including Gateways, Switches, Access Points, and OLTs - because site credentials are hashed with a legacy algorithm that lacks adequate protection against offline cracking (CWE-759). An attacker who has already obtained privileged access to the device or management environment and extracted stored credential hashes can recover plaintext credentials, enabling unauthorized access to affected Omada infrastructure. No public exploit code has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog, though a vendor patch is available.
Provisioning data interception in TP-Link Omada's cloud-based device adoption workflow allows a low-privileged network attacker to receive configuration secrets intended for a legitimate device. The vulnerability is a classic race condition (CWE-362): an attacker who can interact with the adoption workflow before a legitimate device completes registration can position themselves to receive the provisioning payload. Affected products span the full Omada ecosystem - controllers, access points, switches, and gateways. No public exploit or CISA KEV listing exists at time of analysis, but the confidentiality impact is rated High by the vendor's own CVSS 4.0 assessment.
Insufficient entropy in session key generation within the TP-Link Omada adoption protocol exposes encrypted controller-to-device communications to decryption by adjacent network attackers. The adoption protocol - the handshake sequence by which Omada Controllers onboard and establish management sessions with gateways, switches, and access points - generates session encryption keys with insufficient randomness, making them potentially recoverable through cryptanalytic means after traffic interception. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the CVSS 4.0 score of 6.9 and the high confidentiality impact on both the vulnerable and subsequent systems indicate meaningful confidentiality risk for organizations relying on Omada-managed network infrastructure.
Shared embedded certificates across all TP-Link Omada deployments enable impersonation of trusted controllers and managed devices by any attacker who extracts those certificates from a single unit. The CVSS 4.0 vector (AV:A/PR:N/VC:H/SC:H) confirms that an unauthenticated attacker with adjacent network access to the Omada management plane can intercept management communications at high confidentiality impact across both the vulnerable and subsequent systems, with no patch complexity required beyond certificate possession. No public exploit has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog, though the authentication-bypass tagging and the breadth of affected product lines (gateways, switches, access points, controllers, OLTs) give this meaningful real-world weight in environments relying on Omada for network management.
Hard-coded cryptographic keys in the TP-Link Omada adoption protocol allow adjacent-network attackers to impersonate trusted controllers or managed devices, exposing sensitive authentication material exchanged during device adoption. The flaw affects the entire Omada product line - gateways, switches, access points, and controllers - because all share the same embedded keys, meaning any attacker who extracts the keys from firmware can spoof identity during any adoption event on the same network segment. No public exploit or CISA KEV listing exists at time of analysis, but a vendor patch is available and should be applied promptly given the high confidentiality impact on subsequent systems.
Authentication bypass in the TDDP v2 service of the TP-Link RE305 V3 range extender lets an unauthenticated attacker on the same local network forge protocol packets using a fixed, derivable cryptographic key and reach privileged TDDP operations, including functionality that can result in operating-system command execution with root privileges. Only devices running RE305 V3 firmware before 1.1.8 Build 20260921 Rel. 42853 are affected, and exploitation requires the TDDP service to be running and reachable from the attacker's adjacent network segment (CVSS 4.0 8.7 / assessed CVSS 3.1 8.7, AV:A). A vendor patch is available and no public exploit has been identified at time of analysis; the priority label is this_week because the flaw yields full confidentiality, integrity and availability impact once an attacker has local network presence.
Improper authentication (CWE-287) in TP-Link Tapo C210 V3.60 firmware lets an attacker positioned on the same adjacent network retrieve shared credential material and cryptographic metadata by sending unauthenticated DS JSON API requests to the camera, without any credentials or user interaction. The recovered shared credential is then accepted by the Streamd Digest authentication mechanism as the administrative password, so the attacker can establish encrypted media sessions and view the camera's protected streams without ever knowing the device account password. Impact is confined to confidentiality - high credential/crypto disclosure and unauthorized media-session access - with no integrity or availability effect cited; exploitation requires local LAN/Wi-Fi adjacency and is not reachable directly from the internet, and no public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated stack-based buffer overflow in TP-Link Tapo C320WS V2.0 cameras lets an attacker on the adjacent network who already holds valid device credentials overwrite stack memory through an oversized encrypted password field submitted to the local onboarding Wi-Fi configuration path, ultimately executing commands as root. Because the trigger lives in the provisioning endpoint that is only reachable on the local or onboarding LAN (not from the internet) and requires high-privilege authentication, exploitation is conditionally gated rather than broadly opportunistic; no public exploit code or confirmed active exploitation was identified at time of analysis. Successful abuse lets the attacker take control of the camera, alter its behavior, read sensitive local configuration, and disrupt availability, and TP-Link has published fixed firmware on its download portal.
Improper authentication in the local device-management protocol of TP-Link Kasa smart plugs, switches, dimmers, and bulbs lets an unauthenticated attacker who is already on the same Wi-Fi/LAN segment send management instructions to the device, changing device state and settings or disrupting legitimate user control. The vendor scores this 8.7 (CVSS 4.0 AV:A/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity, and availability impact to the device), and the independent assessment agrees: authentication is not required within the adjacent network (PR:N, CWE-306), but the ADJACENT attack vector confines exploitation to attackers holding a foothold on the local segment rather than the public internet. No public exploit code has been identified at time of analysis, and the described cloud-account information exposure is conditional - it depends on concurrent user, mobile-app, and device-cloud interaction - so full account compromise is not guaranteed.
Predictable pre-shared key generation in the TP-Link Tapo C325WB V2 camera's local media streaming service allows an unauthenticated attacker on the adjacent network to recover the key and authenticate to the stream without credentials. This enables access and takeover of live video and audio feeds, compromising confidentiality and integrity. The vulnerability is rated 8.7 (High) with no public exploit identified at time of analysis; a vendor firmware patch is available.
TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass in its HTTPS JSON API dispatcher that allows an attacker on the adjacent network to append an onboarding-scoped object to a JSON request and thereby skip session verification, invoking privileged actions without credentials. Successful exploitation can expose live video and audio, modify device settings, and disclose sensitive device information or secrets. The vendor has released patched firmware, no public exploit code was identified at time of analysis, and independent assessment rates the issue high severity under CVSS 3.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with the adjacent-network requirement the primary limiting factor.
Unauthenticated denial of service in the TP-Link Tapo C325WB v2 camera allows a crafted pair of RTSP-over-HTTP tunneling requests sent to the streaming service on TCP port 554 to corrupt memory (stack-based buffer overflow, CWE-121) and crash the streaming daemon, disrupting live video and related streaming functions until the daemon recovers or restarts. Only cameras with the optional Camera Account feature enabled are exposed, and the attacker must be positioned on the same adjacent network segment (Wi-Fi or LAN) as the camera, since the assessed vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; no authentication or user interaction is required. Impact is availability-only and temporary, no public exploit identified at time of analysis, and a vendor patch is available per the TP-Link firmware release notes and advisory FAQ 5333.
Unauthenticated attackers with adjacent-network access can crash the TDP daemon on TP-Link Tapo C500 v2.0 cameras by sending a single crafted UDP datagram, causing a denial-of-service condition. The flaw is an out-of-bounds function-pointer dispatch (CWE-823) that triggers an invalid indirect call, and the CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) plus our independent CVSS 3.1 assessment (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirm only availability is impacted-no data disclosure or code execution. No public exploit code or active exploitation is identified in the provided data, but the vendor has released a patch; the attack requires Layer-2 adjacency and no authentication, session, or pairing.
Command injection in the TDDPv2 service (/usr/bin/tddp) on TP-Link Archer AX90 V1 routers allows an unauthenticated attacker who is already positioned on the same adjacent network layer - wired LAN, Wi-Fi, or guest network - to inject operating system commands through the setProductVer command handler, which then run as root. The injected payload is executed during device boot, so the attacker must wait for or induce a reboot, and the device is not exploitable over the internet; a fixed firmware release is available from the vendor. Analysis found no public exploit code (no public exploit identified at time of analysis) and the issue is not in CISA KEV, so this is assessed as a credible but above-average-priority fleet risk rather than an internet-wide emergency.
Stack-based buffer overflow in the TDDPv2 service (/usr/bin/tddp) on TP-Link Deco M9 Plus v2 mesh units lets a network-adjacent, unauthenticated attacker crash the device or potentially execute arbitrary code, but only while the unit is in its setup/provisioning phase. A crafted TDDP request whose decrypted payload is longer than the fixed-size stack buffer used by the subtype 0x91 handler (CWE-121) triggers the overflow with no user interaction. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; TP-Link has published fixed firmware. The risk is genuine but conditionally gated: the attacker must already sit on the same Wi-Fi/link-local segment during onboarding, which substantially narrows realistic exposure.
Command execution and administrative-session bypass in TP-Link Tapo C120 v1 and C200 V5 cameras let an unauthenticated attacker on the same local network replay login challenge data, enable a privileged service that becomes reachable after reboot, and inject commands via the MacTool handler. The vendor reports a patch is available, and no public exploit code or CISA KEV active-exploitation entry was identified at time of analysis. Our independent assessment rates this as a credible, above-average-priority issue but not a drop-everything emergency because the attack requires same-LAN access, successful challenge replay, service activation, and a reboot.
Denial of service in TP-Link Tapo C120 v1 and C200 v5 cameras allows an unauthenticated attacker on an adjacent network segment to overwrite the device's wireless onboarding parameters and force it to join a different network, after which the camera becomes unreachable at its management address. The root cause is a missing-authentication condition (CWE-306) in the HTTPS onboarding 'do' method connect actions that persists after initial setup, so no credentials and no user interaction are required, although exploitation is limited to attackers on the same local or wireless segment and the outcome is availability-only with no confidentiality or integrity impact. No public exploit identified at time of analysis, and a vendor firmware update addressing the issue is available per TP-Link's advisory and download pages.
Denial of service affecting TP-Link Tapo C120 v1 and C200 v5 security cameras, where a malformed HTTPS onboarding connect request that omits the password field for certain authentication and encryption parameter combinations triggers a NULL pointer dereference (CWE-476) in the request parser and crashes the HTTPS management service. The endpoint is reachable without authentication once the device has completed initial setup, but attackers must already sit on the same local network segment (CVSS 4.0 vector AV:A/PR:N, assessed equivalent CVSS 3.1 AV:A/AC:L/PR:N/UI:N with availability-only impact), so internet-facing exposure is not the default scenario. Impact is confined to temporary loss of HTTPS management functions, with sustained outages requiring repeated malformed requests and some cases necessitating a manual device reboot; no public exploit code was identified at time of analysis and no CISA KEV entry exists, and the vendor has published firmware release notes addressing the flaw.
OS command injection in TP-Link Deco BE11000 V2's TDDP (TP-Link Device Debug Protocol) module enables unauthenticated adjacent-network attackers to execute arbitrary commands with root privileges by sending a single crafted UDP packet. The vulnerability results in complete device compromise, covering unauthorized command execution, configuration modification, and total loss of confidentiality, integrity, and availability. A vendor firmware patch is available via the TP-Link support page; no public exploit has been identified at time of analysis.
Stack-based buffer overflow in the EasyMesh daemon of the TP-Link Archer AX55 v4 allows a LAN-adjacent unauthenticated attacker to crash the easymesh process and potentially achieve remote code execution on the router, provided Mesh mode is enabled. The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N) correctly constrains the attack to the local network segment with high complexity due to the Mesh mode prerequisite. TP-Link has released a patched firmware; no public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in TP-Link TL-MR100 V3.20 allows an adjacent unauthenticated attacker to corrupt the httpd process stack by sending a crafted encrypted payload to the /cgi/login endpoint before any authentication occurs. The flaw resides in the http_gdpr_decrypt function, which performs insufficient bounds checking on incoming data, enabling overwrite of saved control-flow data and potential arbitrary code execution in the context of the httpd process. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized device control of TP-Link Kasa smart home devices is achievable by any attacker with local network adjacency, due to missing required cryptographic protections (CWE-325) in the local LAN communication protocol. At least 20 distinct Kasa product models are affected, spanning smart plugs, power strips, outdoor outlets, and in-wall switches. Exploitation enables interception, replay, and forgery of device control messages with no authentication required, allowing complete operational manipulation or denial-of-service of affected hardware.
Stored OS command injection in the TP-Link Archer BE3600 V1 parent-control module allows an authenticated administrative attacker on the adjacent network to achieve arbitrary command execution on the device. The payload is persisted at configuration time-embedded in a crafted profile name-and fires asynchronously when the router's daily cloud report generation job runs, without any further attacker interaction. A vendor-released patch is available from TP-Link; no public exploit has been identified at time of analysis.
Root-level command injection in the TP-Link Archer BE800 V1 router (firmware prior to 1.4.2 Build 260708) allows an authenticated administrator on an adjacent network to execute arbitrary OS commands with root privileges by injecting shell metacharacters through the VPN connection interface. Successful exploitation hands an attacker full control of the embedded Linux environment, enabling persistent backdoors, credential theft, and use of the router as a pivot into the connected LAN. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released firmware patch is available.
Unauthenticated OS command injection in TP-Link Archer BE800 V1, BE3600 V1, and AX75 V1 routers allows any LAN-adjacent attacker to execute arbitrary commands with root privileges via the parental control subsystem. Exploitation requires no credentials and no user interaction, resulting in complete device compromise including full control over routing, firewall policy, and all traffic transiting the device. Vendor-released firmware patches are available for all three affected models; no public exploit code or CISA KEV listing has been identified at time of analysis.
Hard-coded RSA-512 mesh group private key in TP-Link Deco XE75 v3, XE5300 v3.6, and WE10800 v3.6 firmware allows an adjacent attacker to impersonate a trusted mesh node without possessing any device-specific credential. Because the same private key is shared across all affected devices and embedded in firmware images that TP-Link publishes publicly on its download portal, the barrier to key extraction is low. No public exploit or active exploitation has been identified at time of analysis, but a vendor-released patch is available.
Stack-based out-of-bounds write in the TP-Link TL-MR6400 v7 administrative web interface login handler allows an unauthenticated attacker with adjacent network access to crash the web management service by sending a specially crafted malformed HTTP request. The vulnerability (CWE-787) is confined to the login request parsing path and requires no authentication or user interaction, though exploitation is bounded by the adjacent network attack vector. Impact is limited to a denial-of-service condition - temporary loss of management interface access - with no confirmed confidentiality or integrity impact; no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
NULL pointer dereference in TP-Link TL-MR6400 v7's HTTP request parsing crashes the management daemon when an unauthenticated adjacent-network attacker sends a specially crafted request containing a malformed session cookie header. Successful exploitation results in a denial-of-service condition, disabling the web management interface and CGI functionality until service recovery - no confidentiality or integrity compromise is possible. No active exploitation has been confirmed (not in CISA KEV), no public proof-of-concept code has been reported, and a vendor patch is available.
Stack-based buffer overflow in TP-Link TL-MR6400 v7 firmware update functionality enables an authenticated, adjacent-network attacker to achieve arbitrary code execution on the affected device. The flaw (CWE-121) arises from unsafe parsing of attacker-controlled metadata embedded in a firmware image, leading to memory corruption at the stack level. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is further constrained by requirements for high-privilege access (PR:H) and network adjacency (AV:A).
Pre-authentication OS command injection in TP-Link Omada gateways (ER-series and DR-series VPN routers) lets an unauthenticated remote attacker execute arbitrary commands when the device is configured as an OpenVPN Server, because client-supplied data is insufficiently validated during OpenVPN connection establishment before authentication completes. Successful exploitation can yield full device compromise (CVSS 4.0 9.3, CWE-78). No public exploit has been identified at time of analysis, and the flaw was reported by the vendor (TP-Link) itself.
OS command injection in the TP-Link Archer C20 v6 web management interface enables an authenticated administrator to execute arbitrary system commands by submitting crafted WAN configuration inputs that bypass insufficient input validation. Full device compromise - confidentiality, integrity, and availability - is achievable for all traffic routed through the affected device. TP-Link has released a patched firmware; no public exploit code or CISA KEV listing has been identified at time of analysis.
Null pointer dereference in the RTSP service of TP-Link Tapo C100 V5 and C101 V5 IP cameras allows an unauthenticated attacker on the same local network segment to crash the video streaming service and trigger a full device reboot. The flaw is rooted in improper pointer validation during RTSP request parsing (CWE-476), with impact limited strictly to availability - no data exfiltration or configuration tampering is possible. A vendor-released firmware patch is available; no public exploit code or CISA KEV listing has been identified at the time of analysis.
Buffer overflow in the TP-Link Tapo P110 v1 smart plug's HTTP request handling allows an adjacent-network attacker to crash the web service process, resulting in a denial-of-service condition. The device's web service performs a memory copy of HTTP request body data without validating input length against the destination buffer, enabling an oversized payload to corrupt adjacent memory regions. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released firmware patch is available via the TP-Link download portal.
OS command injection in the VPN module of TP-Link Archer AXE75 V1 routers allows an adjacent, authenticated attacker with administrator-level access to achieve full device compromise by importing a specially crafted VPN client configuration file. Improper filtering of special characters (CWE-78) in configuration input permits injection of arbitrary OS commands, granting an attacker complete control over the device including configuration integrity, network routing, and service availability. No public exploit identified at time of analysis; vendor-released patch is available.
Remote code execution and denial-of-service in the TP-Link TL-WR940N v6 router stem from a stack-based buffer overflow in the kernel-resident RTSP connection-tracking (ALG) module. An attacker who lures a LAN-side client into connecting to an attacker-controlled RTSP server can send a crafted RTSP message that the router's kernel helper mishandles, potentially yielding full device compromise. The flaw is exploitable by an unauthenticated attacker against the router's default configuration; no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Use of a hard-coded, device-shared cryptographic private key in TP-Link Kasa EC71 v4 and EC70 v4 camera firmware lets an adjacent-network attacker impersonate the device's web management service and break its transport encryption. Because the same private key is baked into every unit's read-only filesystem, anyone who extracts it from one firmware image can passively decrypt or actively man-in-the-middle traffic to any other device on the local network without authentication. TP-Link (the reporting vendor) has released fixed firmware; there is no public exploit identified at time of analysis and the CVE is not in CISA KEV.
Credential disclosure in TP-Link Deco M5 v1 mesh routers stems from a weak (computationally cheap) password-hashing scheme used to store local user credentials, letting an attacker who has already obtained the stored hash recover the plaintext password via offline brute-force or dictionary attacks. Affected devices are the Deco M5 v1 hardware revision, and successful cracking yields access to device management functions scoped to the recovered account's privileges. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the CVSS 4.0 vector (AV:L/AC:H/PR:H) reflects that it is a post-compromise credential-recovery weakness rather than a remote entry point.
OS command injection in the TP-Link Archer VX1800v (v1) router lets an adjacent, high-privileged attacker inject shell metacharacters through the domain name parameter of an HTTP management interface, yielding arbitrary command execution as root and full device takeover. The flaw scores CVSS 4.0 8.5 (High) and a vendor firmware patch is available; no public exploit identified at time of analysis. Note a naming discrepancy in the source data - the free-text description says 'VX800v' while the CPE and tags reference 'VX1800V' - so verify the exact affected model against the TP-Link advisory before acting.
Root-level OS command injection in the TR-069/CWMP management client of the TP-Link Archer VX1800v v1 gateway lets an attacker who controls (or has compromised) the ACS provisioning server inject unsanitized parameters that the device executes as system-level commands. Because CWMP provisioning is trusted implicitly, a malicious or hijacked ACS can push crafted values that yield arbitrary command execution as root and full device takeover. No public exploit identified at time of analysis, and the flaw was reported by TP-Link itself; a firmware fix is available.
Remote denial-of-service in the TP-Link Tapo C200 v3 home security camera allows an unauthenticated attacker on the adjacent network to crash or destabilize the device by sending malformed IPv4 fragmented packets. Exploitation drives excessive resource consumption (CWE-770) and renders the camera unresponsive, causing intermittent loss of live video monitoring and recording. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; TP-Link, who reported it, has released a firmware fix.
Command injection in TP-Link Archer and TL-MR series routers allows an adjacent unauthenticated attacker on the same broadcast domain to execute arbitrary commands with elevated privileges by supplying crafted DHCP option responses. The flaw resides in DHCP client option processing during device initialization and is most reliably triggered when the router is in factory-default or unconfigured state. No public exploit identified at time of analysis, but the vendor (TP-Link) has confirmed the issue and released firmware patches.
Authenticated OS command injection in the TP-Link TL-WR940N v6 router's IPv6 PPPoE configuration handler allows administrators to break out of the configuration parser and execute arbitrary shell commands with elevated (typically root) privileges on the device. The flaw was reported by TP-Link itself and a firmware fix is available; no public exploit identified at time of analysis. Risk is bounded by the CVSS 4.0 vector requiring adjacent-network access and high privileges (AV:A/PR:H), but post-exploitation impact on confidentiality, integrity, and availability is rated High.
Authenticated OS command injection in the TP-Link TL-WR940N v6 router's BigPond Cable (BPA) WAN configuration module allows administrators to execute arbitrary system commands with elevated privileges on the device. The flaw stems from improper sanitization of user-supplied input in the WAN setup path and affects firmware versions prior to V6_260528. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated format string vulnerability in the ONVIF service of TP-Link Tapo C110 v2 cameras allows adjacent-network attackers with valid credentials to manipulate stack memory and redirect execution to internal functions, triggering an unauthorized factory reset. Successful exploitation wipes configuration, deletes stored credentials, and disrupts video surveillance service. No public exploit identified at time of analysis, and the issue is not on CISA KEV.
OS command injection in the VPN module of TP-Link Archer AX12 v1, AX17 v1, AX18 v1, and AX1300 v1.6 routers allows an authenticated attacker on an adjacent network to execute arbitrary commands by uploading a malicious VPN client configuration file. The flaw stems from improper sanitization of special characters during configuration import (CWE-78) and carries a CVSS 4.0 base score of 8.5. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV, but TP-Link has released firmware fixes for all affected models.
Authenticated command injection in the TP-Link Archer MR600 v5 router allows administrators on the adjacent network to execute arbitrary OS commands via the WireGuard client configuration in the web management interface. The flaw stems from improper neutralization of user-controlled input when configuration changes are applied, enabling full device compromise. No public exploit identified at time of analysis, but TP-Link has released a firmware patch.
Authorization bypass in TP-Link Tapo C520WS v2 cameras allows holders of restricted accounts (such as hub users) to execute privileged operations they are not entitled to perform. By abusing the device API's legitimate method mapping behavior, an authenticated low-privilege attacker on the adjacent network can disguise sensitive calls as whitelisted ones, leading to integrity loss and high availability impact including device resets and configuration changes. No public exploit identified at time of analysis, and the issue was reported by TP-Link itself with a vendor patch available.
Denial of service in the RTSP server of TP-Link Tapo C520WS v2 IP cameras allows adjacent network attackers to render the camera's video streaming service non-responsive by sending syntactically invalid RTSP input. The flaw is reachable without authentication or user interaction from the local network segment (CVSS 4.0 vector AV:A/PR:N/UI:N) and no public exploit identified at time of analysis. While confidentiality and integrity are unaffected, availability of the surveillance stream is fully impacted, which is operationally significant for a security camera.
Denial of service in TP-Link Tapo C200 v5 IP cameras allows adjacent network attackers to crash the RTSP service and force a device reboot by sending a crafted Authorization header in an RTSP authentication request. The flaw is a stack-based buffer overflow (CWE-121) in the RTSP authentication handler; no public exploit identified at time of analysis, but vendor-acknowledged and patched firmware is available from TP-Link.
Cleartext Bluetooth transmission in TP-Link Tapo L535E, P300, and D100C devices allows adjacent attackers to intercept and manipulate initial setup data, enabling potential unauthorized device control during onboarding. The flaw stems from missing encryption on the Bluetooth pairing channel used only during initialization, and TP-Link has released patched firmware versions for all affected models. No public exploit identified at time of analysis, but the low complexity and absence of authentication make this a meaningful risk for users provisioning devices in dense urban or office environments.
Credential brute-forcing against TP-Link Archer C64 v1 routers is possible via an undocumented debug SSH service that shares credentials with the web admin interface but enforces no authentication rate-limiting. Adjacent attackers (same Wi-Fi or LAN segment) can iterate password guesses without lockout to recover the administrator password and take full control of the router. No public exploit identified at time of analysis; CVSS 4.0 base score is 8.7 (High) and a vendor patch is available.
Administrative password reset in multiple TP-Link Wi-Fi range extenders (Archer RE650/RE305/RE360 v1, TL-WA860RE v4, RE580D v1) lets an unauthenticated attacker on the adjacent wireless/LAN network tamper with a login parameter to bypass authentication and take over the device. The flaw stems from insufficient validation of a client-supplied login parameter, yielding full admin control with no credentials or user interaction. There is no public exploit identified at time of analysis and EPSS is low (0.10%), but the vendor has released patched firmware.
OS command injection in TP-Link Archer AX53 v1.0 dnsmasq module allows authenticated adjacent attackers to execute arbitrary code through maliciously crafted configuration files. Successful exploitation enables device configuration modification, sensitive data access, and complete system compromise. Affects TP-Link Archer AX53 v1.0 firmware versions prior to 1.7.1 Build 20260213. Requires high-privilege adjacent network access (CVSS:4.0 AV:A/PR:H). No public exploit identified at time of analysis.
OS command injection in TP-Link Archer AX53 v1.0 OpenVPN module allows authenticated adjacent attackers to execute arbitrary system commands through maliciously crafted configuration files. Exploitation requires high-privilege adjacency access but enables complete device compromise including configuration modification, credential disclosure, and persistent backdoor installation. Affects AX53 v1.0 firmware prior to 1.7.1 Build 20260213. No public exploit identified at time of analysis.
Stack-based buffer overflow in TP-Link Archer AX53 v1.0 tmpServer module enables authenticated adjacent attackers to execute arbitrary code via malicious configuration file. Exploitation triggers segmentation fault, permits device state modification, sensitive data exposure, and integrity compromise. Affects firmware versions before 1.7.1 Build 20260213. Requires high privileges and adjacent network access. No public exploit identified at time of analysis.
Denial-of-service vulnerability in TP-Link Tapo C520WS v2.6 camera allows adjacent network attackers to trigger buffer overflow through crafted HTTP requests with excessively long paths that bypass initial length validation during path normalization, resulting in memory corruption and device reboot without requiring authentication. Vendor has released a patch; no public exploit code identified at time of analysis.
Stack-based buffer overflow in TP-Link Tapo C520WS v2.6 allows remote attackers to trigger denial-of-service by sending oversized configuration parameters to a vulnerable configuration handling component. Successful exploitation causes device crash or reboot, impacting camera availability. Vendor has released a patch.
TP-Link Tapo C520WS v2.6 contains an authentication bypass in its HTTP-based DS configuration service that allows unauthenticated attackers to execute privileged device configuration actions by appending authentication-exempt parameters to requests. The vulnerability stems from inconsistent JSON request parsing and authorization logic, enabling unauthorized modification of device state without requiring valid credentials. No public exploit code has been identified at time of analysis, and a vendor-released patch is available.
Heap-based buffer overflow in TP-Link Tapo C520WS v2.6 allows local network attackers to cause denial of service by sending crafted payloads during asynchronous video stream processing, triggering memory corruption and process crashes. The vulnerability stems from insufficient buffer boundary validation in streaming input handling. A vendor patch is available.
Heap-based buffer overflow in TP-Link Tapo C520WS v2.6 allows unauthenticated network attackers to trigger denial-of-service by sending crafted HTTP payloads that bypass boundary validation during segmented request body parsing. The vulnerability exploits insufficient write-boundary verification in the HTTP parsing loop, causing heap memory corruption that crashes or hangs the device process. Patch is available from the vendor.
Heap-based buffer overflow in TP-Link Tapo C520WS v2.6 allows remote attackers on the same network segment to trigger denial-of-service by sending crafted HTTP POST payloads that exceed allocated buffer boundaries. The vulnerability stems from missing validation in HTTP body parsing logic, causing process crashes or unresponsiveness. No CVSS score or vector data is available, limiting precise severity quantification, but the practical attack vector is network-adjacent and does not require authentication.
An out-of-bounds read vulnerability in the UPnP service of TP-Link TL-WR841N v14 routers enables adjacent network attackers to crash the UPnP daemon without authentication, resulting in denial of service. Affected devices include firmware versions prior to EN_0.9.1 4.19 Build 260303 and US_0.9.1.4.19 Build 260312. Vendor patches are available. No public exploit identified at time of analysis, with CVSS:4.0 scoring 7.1 (High) reflecting adjacent network access requirements and high availability impact.
Authenticated attackers can achieve root-level command execution on TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 routers by uploading a malicious configuration file through the import function, exploiting improper input validation in the port-trigger processing logic. Successful exploitation grants complete control over the affected device, allowing full compromise of the router and any connected network. A patch is available for this high-severity vulnerability.
Unauthenticated attackers can trigger out-of-bounds memory access in the web interface of multiple Omada switches through improper input validation, potentially achieving remote code execution or causing denial-of-service. Affected products include Sg2005p PD 1.x, Sg2008 4.2x/4.3x, and Sg2008p 3.2x/3.3x, which require only network access to the vulnerable interface. A patch is available to address this high-severity vulnerability (CVSS 7.7).
The country/region configuration interface of the TP-Link RE305 V3 range extender lacks an authorization check, so anyone who can reach it from the same local network - joined to its Wi-Fi or on the same LAN - can rewrite the wireless regulatory region and force the device to reapply its wireless configuration, with no credentials or user interaction needed. The practical result is limited to wireless availability: interrupted connections, unavailable channels, client disconnections and unstable service, plus operating parameters meant for a different regulatory domain; there is no loss of confidentiality or of device-data integrity. Exploitation is constrained to the adjacent network segment rather than the internet, so exposure depends on who can join that local wireless or wired network. No public exploit code was identified at time of analysis, and TP-Link has released fixed firmware.
OS command injection in the tmpServer/TDDPv1 service of the TP-Link RE305 V3 range extender lets a low-privileged local attacker run arbitrary operating-system commands as root on the device. The service listens only on the local loopback interface, so the attacker must already hold some on-device execution foothold; there is no network-reachable path and no scope change beyond the extender itself. No public exploit code was identified at time of analysis, and TP-Link has released firmware 1.1.8 Build 20260921 Rel. 42853 that removes the flaw, making this a moderate, situational priority (patching this month) rather than an emergency.
Administrator account takeover in TP-Link RE305 V3 Wi-Fi range extenders: the device's unauthenticated password-recovery verification-code interface can be driven by anyone positioned on the same LAN or Wi-Fi to generate an administrator password-reset code, and the code can then be obtained or brute-forced. Two weaknesses enable this - the interface has no effective attempt counter or lockout, and the verification code is produced by a predictable generation process (CWE-338). Exploitation requires an adjacent-network position (the vector is AV:A, so this is not reachable from the internet) and a brute-force or prediction effort (AC:H); no public exploit or PoC has been identified at time of analysis and the CVE is not in CISA KEV. Successful abuse lets the attacker reset the admin password and reach privileged device-management functions, with high integrity impact but limited confidentiality and availability impact.
Hard-coded AES-128 key and IV values in TP-Link RE305 V3 and Archer C7 V5 configuration backups allow anyone who obtains an exported backup file to decrypt it and recover administrator passwords and Wi-Fi credentials. Affected firmware is RE305 V3 before 1.1.8 Build 20260921 Rel. 42853 and Archer C7 V5 before 1.3.1 Build 20260821 Rel. 41256; exploitation requires possession of a backup file and has no remote path against a running device (CVSS 4.0 base 6.9, local vector). Vendor patches are available, and no public exploit was identified in the supplied intelligence at time of analysis.
Information disclosure in TP-Link Deco BE63 v2.0 lets an attacker who already holds administrative privileges on the device, and can reach it from an adjacent LAN or Wi-Fi segment, query the cloud-client daemon and recover the linked TP-Link ID account password in plaintext. That credential could then be used to access the associated TP-Link cloud account and perform actions as the affected user. The vendor has released a firmware update, and no public exploit was identified at time of analysis; the independent assessment rates this as a constrained medium-severity risk because exploitation requires admin access and adjacent-network positioning.
TP-Link Archer C6 V2 routers use a device-universal hardcoded cryptographic key to protect exported configuration backups and stored credential data, so anyone who obtains such an encrypted artifact can decrypt it and recover plaintext administrative credentials. This is a moderate-severity confidentiality issue (CVSS 4.0 base 5.9; assessed CVSS 3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) because exploitation requires possession of the encrypted configuration file-typically after an administrative export, backup leak, support/RMA exposure, or prior compromise-rather than direct remote decryption. No public exploit has been identified at time of analysis, and TP-Link has released updated firmware for Archer C6 V2.
Authentication bypass in the TP-Link Tapo C210 V3.60 DS JSON API allows attackers on the adjacent network to execute protected camera operations, including pan-tilt-zoom (PTZ) control, without a valid authenticated session. The flaw is rated moderate severity (CVSS 5.3; CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) because exploitation is confined to the same LAN/Wi-Fi segment and the impact is limited to camera functionality manipulation rather than full device takeover. No public exploit code was identified at time of analysis, and CISA KEV status does not indicate active exploitation; TP-Link has released patched firmware.
TP-Link Tapo C500 v2.0 cameras with the ONVIF PTZ interface enabled are vulnerable to an out-of-bounds stack write (CWE-121) that can be triggered by an authenticated ONVIF client sending an excessive number of preset-related elements to the PTZ SOAP handlers, resulting in a service crash and denial-of-service. Exploitation requires valid ONVIF credentials and adjacency to the camera's network (CVSS 4.0: 6.8, AV:A/PR:H), and while the attacker cannot execute code or access data, repeated crashes can disrupt camera management and PTZ functionality until the service restarts. TP-Link has released a firmware patch, and no public exploit code has been identified at time of analysis.
Physical attackers who can obtain, disassemble and hardware-modify a TP-Link Kasa EC70 v4 or EC71 v4 smart plug can restore the manufacturing-severed debug traces, interrupt the boot process and manipulate boot parameters to reach a non-standard initialization path that spawns an unauthenticated root shell during startup, giving full root-level control over the device (high confidentiality, integrity and availability impact to the device itself). The root cause is improper access control on the on-chip debug interface (CWE-1191): the production debug interface is not logically disabled at the firmware or chip level and the bootloader is not locked, so the physical cut of the debug traces is the only barrier. The attacker path is purely physical (CVSS 4.0 AV:P/AC:L/AT:P, assessed as CVSS 3.1 AV:P/AC:H), with no remote or over-the-air vector, and exploitation demands disassembly, trace rework (resoldering/bridging) and boot-timing manipulation; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, while vendor firmware updates are available per the TP-Link release notes.
Unauthenticated devices on the same local network segment as a TP-Link Tapo C120 v1 or Tapo C200 V5 camera can invoke the HTTPS onboarding scan function and pull back metadata about nearby wireless access points, including SSIDs, BSSIDs, authentication and encryption modes, and signal-strength readings (CWE-306, missing authentication for a critical function). The flaw is only reachable after the camera has completed initial setup and requires the attacker to already have adjacent-network access (CVSS:4.0 AV:A/PR:N/UI:N, base 5.3; our own assessment scores it CVSS:3.1 3.1 AV:A/AC:L/PR:N/UI:N with C:L only), so it is not internet-exploitable and yields reconnaissance-grade wireless topology data rather than code execution, credential theft, or camera/video access. There is no KEV listing and no public exploit identified at time of analysis, and TP-Link has published firmware updates for both hardware revisions. This is a genuine but low-to-moderate priority issue, not a critical one, and the practical risk depends entirely on how hostile or shared the camera's LAN/Wi-Fi segment is.
XML External Entity (XXE) injection in TP-Link Omada Controller's SAML SSO metadata parsing allows an authenticated user with SAML configuration privileges to read arbitrary files from the server, resulting in high-confidentiality information disclosure. The vulnerability arises because the controller does not disable external entity resolution when parsing user-supplied SAML metadata XML, enabling server-side file exfiltration. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available.
Authenticated path traversal in the file upload functionality of TP-Link Archer MR600 (v2, v3, v5) and TL-MR6400 v8 allows an admin-level remote attacker to write files outside the intended upload directory, potentially overwriting system files accessible to the affected service. The vendor explicitly states that arbitrary code execution has not been demonstrated, making this an integrity-limited vulnerability rather than a full RCE. Vendor-released firmware patches are available for both affected product lines. No public exploit has been identified at time of analysis.
Missing authentication in VPN configuration management on TP-Link 4G LTE routers (Archer MR600 v2/v3/v5 and TL-MR6400 v8) permits an unauthenticated adjacent-network attacker to read and overwrite VPN credentials and tunnel configuration without any valid credentials. The vendor's CVSS 4.0 vector (AV:A) indicates the attack surface is adjacent-network rather than fully internet-routable, constraining exposure to attackers with local LAN, Wi-Fi, or cellular-segment access. No public exploit has been identified at time of analysis; a vendor-released patch is available via firmware update.
Hard-coded RSA private key exposure in the TP-Link Archer AX55 v4 web module allows a LAN-adjacent attacker who captures HTTP login traffic to decrypt the administrator password, since the shared private key is identical across all units of this model and the AES session key is additionally weakened. All Archer AX55 v4 firmware versions appear affected per the CPE wildcard, with a vendor patch now available via TP-Link's firmware portal. No public exploit code has been identified at time of analysis, though the cryptographic flaw is deterministic - once the static key is extracted from firmware, any captured login session can be decrypted offline.
Cleartext transmission of DDNS authentication credentials in TP-Link Omada business gateway routers exposes sensitive account information to network-positioned attackers. Nineteen distinct hardware models spanning the ER and DR product lines are affected, including the ER605, ER7206, ER8411, and multiple 4G outdoor variants. An attacker with visibility or control over the network path between the gateway and an external DDNS provider can intercept credentials and potentially hijack DDNS management - enabling unauthorized DNS record manipulation for the affected deployment. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Captive portal session management across multiple TP-Link Omada ER and DR series routers exposes unauthenticated session-termination functions to any attacker with adjacent network access, allowing forced logout of specific users or full session clearance without credentials. Nineteen hardware models running firmware prior to late June-July 2026 builds are confirmed affected per EUVD data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity combined with zero authentication requirements makes adjacent-network exploitation straightforward once an attacker is positioned on the same network segment as the captive portal service.
Heap-based buffer overflow in the RTSP service of TP-Link Tapo C100 and C101 V5 IP cameras allows an authenticated attacker on the same local network segment to crash the RTSP service and force a device reboot by sending specially crafted frames with oversized length values. Impact is limited to temporary denial-of-service; no confidentiality or integrity compromise is achievable. No public exploit code has been identified at time of analysis, and TP-Link has released firmware patches for affected devices.
Improper origin validation in the TP-Link TL-WR820N V2 router's web management interface allows adjacent unauthenticated attackers to extract device configuration details and sensitive information by sending HTTP requests with an absent or empty Referer header. The router relies on the HTTP Referer header as a request legitimacy check, but fails to enforce its presence or value consistently, allowing the validation to be trivially bypassed. No public exploit or active exploitation has been identified at time of analysis, though the attack requires only network adjacency and no credentials.
OS command injection in TP-Link Aginet home networking devices (HB, EB, EX, XX, VX series) allows an authenticated attacker on the same network segment to execute arbitrary operating system commands with elevated privileges through unsanitized web interface inputs. The attack vector is adjacent-network only (AV:A per CVSS 4.0), limiting internet-scale exploitation, but a compromised or malicious LAN/Wi-Fi client could fully compromise the affected device. No public exploit code or CISA KEV listing has been identified at time of analysis; TP-Link has released patched firmware across all affected product lines.
Symlink traversal in TP-Link Aginet home networking devices exposes sensitive filesystem files to any attacker who can physically insert a prepared USB storage device. The firmware resolves symbolic links placed on external USB media without validating that the resolved path remains within the intended storage boundary, enabling unauthorized read access to device-internal files such as configuration and credential stores. No public exploit or CISA KEV listing exists at time of analysis; however, the vendor has confirmed patches for all affected models.
Hardcoded cryptographic keys embedded in TP-Link Aginet firmware expose sensitive configuration data to any attacker who gains access to device storage. Affecting over 70 distinct hardware SKUs across the HB, HX, HC, EB, EC, EX, XX, XC, and VX product families, the static keys are identical across all devices sharing a firmware image, meaning key material extracted from one device - or from a publicly downloadable firmware image - decrypts configuration stores on any other device of the same model. Successful exploitation yields plaintext credentials and service configuration, and no public exploit has been identified at time of analysis. TP-Link has released patched firmware for all affected models.
Privilege escalation across more than 60 TP-Link Aginet mesh networking device models allows authenticated low-privileged users to invoke administrative operations - including creating privileged accounts and modifying critical configuration settings - by exploiting insufficient authorization validation (CWE-863). The flaw spans the HB, HX, EX, HC, EB, XX, VX, and XC device families in US, EU, BR, AU, CA, KR, DE, and RU regional variants, with specific vulnerable firmware builds documented per device in ENISA EUVD-2025-210674. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available at the TP-Link advisory.
Authentication bypass in TP-Link Aginet home mesh networking devices allows an adjacent-network attacker without credentials to invoke privileged management operations and gain full administrative control of the device. The flaw (CWE-862, Missing Authorization) stems from inconsistent enforcement of access control checks on specific web management interface endpoints - certain privileged API handlers accept and act on requests without verifying caller identity. The vulnerability affects over 60 distinct model/region/hardware-revision combinations across the HB, HX, EX, HC, VX, and XX Aginet product lines; no public exploit code or CISA KEV listing is identified at time of analysis, but the vendor has released firmware patches.
Arbitrary file write via Zip Slip path traversal in TP-Link's WebUI ISP Upgrade functionality affects three LTE router models - TL-MR6400 v5.3, Archer MR600 v2, and Archer MR200 v7. An authenticated administrator on the adjacent network can upload a crafted archive containing directory traversal sequences (e.g., '../../') to overwrite arbitrary files on the underlying system, compromising integrity and potentially availability. No public exploit code or CISA KEV listing has been identified; vendor-released patches are available as of mid-2026.
Denial-of-service in the TP-Link Archer A6 V4 router's embedded web server allows an authenticated, adjacent-network attacker to crash the httpd process or the device by sending a malformed request to the HTTP-WRITEOEM handler, which fails to validate input before passing it to flash-write logic. All Archer A6 V4 firmware versions prior to V4_1.15.10 Build 260625 Rel.25447 are affected, per EUVD-2026-54656 and TP-Link's own advisory. No public exploit code or active exploitation has been identified at time of analysis.
Denial-of-service in the TP-Link Archer A6 v4 httpd service allows an adjacent, authenticated attacker to crash the web management process or force a device reboot by exploiting a race condition in the asynchronous systool instruction handling path. All firmware builds prior to V4_1.15.10 Build 260625 Rel.25447 are affected; a vendor-released patch has been issued. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog - real-world risk is constrained by the adjacent network and high-privilege prerequisites.
Credential recovery is possible on TP-Link Omada network devices - including Gateways, Switches, Access Points, and OLTs - because site credentials are hashed with a legacy algorithm that lacks adequate protection against offline cracking (CWE-759). An attacker who has already obtained privileged access to the device or management environment and extracted stored credential hashes can recover plaintext credentials, enabling unauthorized access to affected Omada infrastructure. No public exploit code has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog, though a vendor patch is available.
Provisioning data interception in TP-Link Omada's cloud-based device adoption workflow allows a low-privileged network attacker to receive configuration secrets intended for a legitimate device. The vulnerability is a classic race condition (CWE-362): an attacker who can interact with the adoption workflow before a legitimate device completes registration can position themselves to receive the provisioning payload. Affected products span the full Omada ecosystem - controllers, access points, switches, and gateways. No public exploit or CISA KEV listing exists at time of analysis, but the confidentiality impact is rated High by the vendor's own CVSS 4.0 assessment.
Insufficient entropy in session key generation within the TP-Link Omada adoption protocol exposes encrypted controller-to-device communications to decryption by adjacent network attackers. The adoption protocol - the handshake sequence by which Omada Controllers onboard and establish management sessions with gateways, switches, and access points - generates session encryption keys with insufficient randomness, making them potentially recoverable through cryptanalytic means after traffic interception. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the CVSS 4.0 score of 6.9 and the high confidentiality impact on both the vulnerable and subsequent systems indicate meaningful confidentiality risk for organizations relying on Omada-managed network infrastructure.
Shared embedded certificates across all TP-Link Omada deployments enable impersonation of trusted controllers and managed devices by any attacker who extracts those certificates from a single unit. The CVSS 4.0 vector (AV:A/PR:N/VC:H/SC:H) confirms that an unauthenticated attacker with adjacent network access to the Omada management plane can intercept management communications at high confidentiality impact across both the vulnerable and subsequent systems, with no patch complexity required beyond certificate possession. No public exploit has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog, though the authentication-bypass tagging and the breadth of affected product lines (gateways, switches, access points, controllers, OLTs) give this meaningful real-world weight in environments relying on Omada for network management.
Hard-coded cryptographic keys in the TP-Link Omada adoption protocol allow adjacent-network attackers to impersonate trusted controllers or managed devices, exposing sensitive authentication material exchanged during device adoption. The flaw affects the entire Omada product line - gateways, switches, access points, and controllers - because all share the same embedded keys, meaning any attacker who extracts the keys from firmware can spoof identity during any adoption event on the same network segment. No public exploit or CISA KEV listing exists at time of analysis, but a vendor patch is available and should be applied promptly given the high confidentiality impact on subsequent systems.