89
CVEs
1
Critical
56
High
0
KEV
2
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
56
MEDIUM
32
LOW
0
Monthly CVE Trend
Affected Products (30)
Omada Access Points
7
Omada Gateways
7
Omada Switches
7
Tapo C520Ws V2
6
Tapo C520Ws V2 6
6
Ex220 Eu1 V1 0 1 20
5
Xx530V Eu1
5
Vx800V De V1 0
5
Ax53 V1 0
5
Hb610 Ca V2 0
5
Hb210 Pro Eu1 1 0
5
Ex920 Us2 V1 6 V1 0
5
Hb710 Eu1 1 0
5
Ex220 Br V1 0 1 20 1 28 1 29 1 8
5
Hb710 Us2 V1 6 1 0
5
Hb810 Eu1 V2 0
5
Ex220 Ru V1 0
5
Hb610 Us2 V2 6 2 0
5
Hb410 Eu1 1 0
5
Omada Controllers
5
Ex220 Us1 V1 0
5
Ex220 Br V2 0
5
Ex820V Eu1 V1 0
5
Ex222 Kr V1 0
5
Hb210 Us2 1 0
5
Xx530V Br V2 0
5
Ex222 Us1 V1 0
5
Ex222 Eu1 V1 0
5
Hb210 Pro Us2 1 0 1 6
5
Hb210 Eu1 1 0
5
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-19586 | Pre-authentication OS command injection in TP-Link Omada gateways (ER-series and DR-series VPN routers) lets an unauthenticated remote attacker execute arbitrary commands when the device is configured as an OpenVPN Server, because client-supplied data is insufficiently validated during OpenVPN connection establishment before authentication completes. Successful exploitation can yield full device compromise (CVSS 4.0 9.3, CWE-78). No public exploit has been identified at time of analysis, and the flaw was reported by the vendor (TP-Link) itself. | CRITICAL | 9.3 | 5.0% | 52 |
|
| CVE-2026-9254 | Unauthenticated OS command injection in TP-Link Archer BE800 V1, BE3600 V1, and AX75 V1 routers allows any LAN-adjacent attacker to execute arbitrary commands with root privileges via the parental control subsystem. Exploitation requires no credentials and no user interaction, resulting in complete device compromise including full control over routing, firewall policy, and all traffic transiting the device. Vendor-released firmware patches are available for all three affected models; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.7 | 2.3% | 46 |
|
| CVE-2026-12935 | Remote code execution and denial-of-service in the TP-Link TL-WR940N v6 router stem from a stack-based buffer overflow in the kernel-resident RTSP connection-tracking (ALG) module. An attacker who lures a LAN-side client into connecting to an attacker-controlled RTSP server can send a crafted RTSP message that the router's kernel helper mishandles, potentially yielding full device compromise. The flaw is exploitable by an unauthenticated attacker against the router's default configuration; no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 8.7 | 0.8% | 44 |
|
| CVE-2026-11834 | Command injection in TP-Link Archer and TL-MR series routers allows an adjacent unauthenticated attacker on the same broadcast domain to execute arbitrary commands with elevated privileges by supplying crafted DHCP option responses. The flaw resides in DHCP client option processing during device initialization and is most reliably triggered when the router is in factory-default or unconfigured state. No public exploit identified at time of analysis, but the vendor (TP-Link) has confirmed the issue and released firmware patches. | HIGH | 8.7 | 0.4% | 44 |
|
| CVE-2026-11409 | Authenticated OS command injection in the TP-Link TL-WR940N v6 router's IPv6 PPPoE configuration handler allows administrators to break out of the configuration parser and execute arbitrary shell commands with elevated (typically root) privileges on the device. The flaw was reported by TP-Link itself and a firmware fix is available; no public exploit identified at time of analysis. Risk is bounded by the CVSS 4.0 vector requiring adjacent-network access and high privileges (AV:A/PR:H), but post-exploitation impact on confidentiality, integrity, and availability is rated High. | HIGH | 8.5 | 1.3% | 44 |
|
| CVE-2026-11410 | Authenticated OS command injection in the TP-Link TL-WR940N v6 router's BigPond Cable (BPA) WAN configuration module allows administrators to execute arbitrary system commands with elevated privileges on the device. The flaw stems from improper sanitization of user-supplied input in the WAN setup path and affects firmware versions prior to V6_260528. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 8.5 | 1.3% | 44 |
|
| CVE-2026-75118 | Stack-based buffer overflow in TP-Link TL-MR100 V3.20 allows an adjacent unauthenticated attacker to corrupt the httpd process stack by sending a crafted encrypted payload to the /cgi/login endpoint before any authentication occurs. The flaw resides in the http_gdpr_decrypt function, which performs insufficient bounds checking on incoming data, enabling overwrite of saved control-flow data and potential arbitrary code execution in the context of the httpd process. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.7 | 0.2% | 44 |
|
| CVE-2025-30237 | Authentication bypass in TP-Link Aginet home mesh networking devices allows an adjacent-network attacker without credentials to invoke privileged management operations and gain full administrative control of the device. The flaw (CWE-862, Missing Authorization) stems from inconsistent enforcement of access control checks on specific web management interface endpoints - certain privileged API handlers accept and act on requests without verifying caller identity. The vulnerability affects over 60 distinct model/region/hardware-revision combinations across the HB, HX, EX, HC, VX, and XX Aginet product lines; no public exploit code or CISA KEV listing is identified at time of analysis, but the vendor has released firmware patches. | HIGH | 8.7 | 0.2% | 44 |
|
| CVE-2026-76784 | Unauthorized device control of TP-Link Kasa smart home devices is achievable by any attacker with local network adjacency, due to missing required cryptographic protections (CWE-325) in the local LAN communication protocol. At least 20 distinct Kasa product models are affected, spanning smart plugs, power strips, outdoor outlets, and in-wall switches. Exploitation enables interception, replay, and forgery of device control messages with no authentication required, allowing complete operational manipulation or denial-of-service of affected hardware. | HIGH | 8.7 | 0.1% | 44 |
|
| CVE-2026-75616 | OS command injection in the TP-Link Archer C20 v6 web management interface enables an authenticated administrator to execute arbitrary system commands by submitting crafted WAN configuration inputs that bypass insufficient input validation. Full device compromise - confidentiality, integrity, and availability - is achievable for all traffic routed through the affected device. TP-Link has released a patched firmware; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.5 | 1.1% | 44 |
|
| CVE-2026-3294 | Administrative password reset in multiple TP-Link Wi-Fi range extenders (Archer RE650/RE305/RE360 v1, TL-WA860RE v4, RE580D v1) lets an unauthenticated attacker on the adjacent wireless/LAN network tamper with a login parameter to bypass authentication and take over the device. The flaw stems from insufficient validation of a client-supplied login parameter, yielding full admin control with no credentials or user interaction. There is no public exploit identified at time of analysis and EPSS is low (0.10%), but the vendor has released patched firmware. | HIGH | 8.7 | 0.1% | 44 |
|
| CVE-2026-34121 | TP-Link Tapo C520WS v2.6 contains an authentication bypass in its HTTP-based DS configuration service that allows unauthenticated attackers to execute privileged device configuration actions by appending authentication-exempt parameters to requests. The vulnerability stems from inconsistent JSON request parsing and authorization logic, enabling unauthorized modification of device state without requiring valid credentials. No public exploit code has been identified at time of analysis, and a vendor-released patch is available. | HIGH | 8.7 | 0.1% | 44 |
|
| CVE-2026-8697 | Credential brute-forcing against TP-Link Archer C64 v1 routers is possible via an undocumented debug SSH service that shares credentials with the web admin interface but enforces no authentication rate-limiting. Adjacent attackers (same Wi-Fi or LAN segment) can iterate password guesses without lockout to recover the administrator password and take full control of the router. No public exploit identified at time of analysis; CVSS 4.0 base score is 8.7 (High) and a vendor patch is available. | HIGH | 8.7 | 0.0% | 44 |
|
| CVE-2026-15427 | Root-level OS command injection in the TR-069/CWMP management client of the TP-Link Archer VX1800v v1 gateway lets an attacker who controls (or has compromised) the ACS provisioning server inject unsanitized parameters that the device executes as system-level commands. Because CWMP provisioning is trusted implicitly, a malicious or hijacked ACS can push crafted values that yield arbitrary command execution as root and full device takeover. No public exploit identified at time of analysis, and the flaw was reported by TP-Link itself; a firmware fix is available. | HIGH | 8.6 | 0.5% | 44 |
|
| CVE-2025-30241 | OS command injection in TP-Link Aginet home networking devices (HB, EB, EX, XX, VX series) allows an authenticated attacker on the same network segment to execute arbitrary operating system commands with elevated privileges through unsanitized web interface inputs. The attack vector is adjacent-network only (AV:A per CVSS 4.0), limiting internet-scale exploitation, but a compromised or malicious LAN/Wi-Fi client could fully compromise the affected device. No public exploit code or CISA KEV listing has been identified at time of analysis; TP-Link has released patched firmware across all affected product lines. | HIGH | 8.6 | 0.5% | 43 |
|