21
CVEs
1
Critical
13
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.8%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
13
MEDIUM
7
LOW
0
Monthly CVE Trend
Affected Products (30)
Omada Access Points
7
Omada Gateways
7
Omada Switches
7
Tapo C520Ws V2
6
Tapo C520Ws V2 6
6
Ex220 Eu1 V1 0 1 20
5
Xx530V Eu1
5
Vx800V De V1 0
5
Ax53 V1 0
5
Hb610 Ca V2 0
5
Hb210 Pro Eu1 1 0
5
Ex920 Us2 V1 6 V1 0
5
Hb710 Eu1 1 0
5
Ex220 Br V1 0 1 20 1 28 1 29 1 8
5
Hb710 Us2 V1 6 1 0
5
Hb810 Eu1 V2 0
5
Ex220 Ru V1 0
5
Hb610 Us2 V2 6 2 0
5
Hb410 Eu1 1 0
5
Omada Controllers
5
Ex220 Us1 V1 0
5
Ex220 Br V2 0
5
Ex820V Eu1 V1 0
5
Ex222 Kr V1 0
5
Hb210 Us2 1 0
5
Xx530V Br V2 0
5
Ex222 Us1 V1 0
5
Ex222 Eu1 V1 0
5
Hb210 Pro Us2 1 0 1 6
5
Hb210 Eu1 1 0
5
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-19586 | Pre-authentication OS command injection in TP-Link Omada gateways (ER-series and DR-series VPN routers) lets an unauthenticated remote attacker execute arbitrary commands when the device is configured as an OpenVPN Server, because client-supplied data is insufficiently validated during OpenVPN connection establishment before authentication completes. Successful exploitation can yield full device compromise (CVSS 4.0 9.3, CWE-78). No public exploit has been identified at time of analysis, and the flaw was reported by the vendor (TP-Link) itself. | CRITICAL | 9.3 | 5.0% | 52 |
|
| CVE-2026-9254 | Unauthenticated OS command injection in TP-Link Archer BE800 V1, BE3600 V1, and AX75 V1 routers allows any LAN-adjacent attacker to execute arbitrary commands with root privileges via the parental control subsystem. Exploitation requires no credentials and no user interaction, resulting in complete device compromise including full control over routing, firewall policy, and all traffic transiting the device. Vendor-released firmware patches are available for all three affected models; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.7 | 2.3% | 46 |
|
| CVE-2026-75118 | Stack-based buffer overflow in TP-Link TL-MR100 V3.20 allows an adjacent unauthenticated attacker to corrupt the httpd process stack by sending a crafted encrypted payload to the /cgi/login endpoint before any authentication occurs. The flaw resides in the http_gdpr_decrypt function, which performs insufficient bounds checking on incoming data, enabling overwrite of saved control-flow data and potential arbitrary code execution in the context of the httpd process. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.7 | 0.2% | 44 |
|
| CVE-2026-76784 | Unauthorized device control of TP-Link Kasa smart home devices is achievable by any attacker with local network adjacency, due to missing required cryptographic protections (CWE-325) in the local LAN communication protocol. At least 20 distinct Kasa product models are affected, spanning smart plugs, power strips, outdoor outlets, and in-wall switches. Exploitation enables interception, replay, and forgery of device control messages with no authentication required, allowing complete operational manipulation or denial-of-service of affected hardware. | HIGH | 8.7 | 0.1% | 44 |
|
| CVE-2026-75616 | OS command injection in the TP-Link Archer C20 v6 web management interface enables an authenticated administrator to execute arbitrary system commands by submitting crafted WAN configuration inputs that bypass insufficient input validation. Full device compromise - confidentiality, integrity, and availability - is achievable for all traffic routed through the affected device. TP-Link has released a patched firmware; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.5 | 1.1% | 44 |
|
| CVE-2026-78541 | Stored OS command injection in the TP-Link Archer BE3600 V1 parent-control module allows an authenticated administrative attacker on the adjacent network to achieve arbitrary command execution on the device. The payload is persisted at configuration time-embedded in a crafted profile name-and fires asynchronously when the router's daily cloud report generation job runs, without any further attacker interaction. A vendor-released patch is available from TP-Link; no public exploit has been identified at time of analysis. | HIGH | 8.5 | 1.0% | 43 |
|
| CVE-2026-16348 | Root-level command injection in the TP-Link Archer BE800 V1 router (firmware prior to 1.4.2 Build 260708) allows an authenticated administrator on an adjacent network to execute arbitrary OS commands with root privileges by injecting shell metacharacters through the VPN connection interface. Successful exploitation hands an attacker full control of the embedded Linux environment, enabling persistent backdoors, credential theft, and use of the router as a pivot into the connected LAN. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released firmware patch is available. | HIGH | 8.5 | 0.9% | 43 |
|
| CVE-2026-17250 | Stack-based buffer overflow in TP-Link TL-MR6400 v7 firmware update functionality enables an authenticated, adjacent-network attacker to achieve arbitrary code execution on the affected device. The flaw (CWE-121) arises from unsafe parsing of attacker-controlled metadata embedded in a firmware image, leading to memory corruption at the stack level. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is further constrained by requirements for high-privilege access (PR:H) and network adjacency (AV:A). | HIGH | 8.5 | 0.2% | 43 |
|
| CVE-2026-17176 | OS command injection in TP-Link Deco BE11000 V2's TDDP (TP-Link Device Debug Protocol) module enables unauthenticated adjacent-network attackers to execute arbitrary commands with root privileges by sending a single crafted UDP packet. The vulnerability results in complete device compromise, covering unauthorized command execution, configuration modification, and total loss of confidentiality, integrity, and availability. A vendor firmware patch is available via the TP-Link support page; no public exploit has been identified at time of analysis. | HIGH | 7.7 | 3.6% | 42 |
|
| CVE-2026-18167 | Stack-based buffer overflow in the EasyMesh daemon of the TP-Link Archer AX55 v4 allows a LAN-adjacent unauthenticated attacker to crash the easymesh process and potentially achieve remote code execution on the router, provided Mesh mode is enabled. The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N) correctly constrains the attack to the local network segment with high complexity due to the Mesh mode prerequisite. TP-Link has released a patched firmware; no public exploit code or active exploitation has been identified at time of analysis. | HIGH | 7.7 | 0.3% | 39 |
|
| CVE-2026-15469 | Hard-coded RSA-512 mesh group private key in TP-Link Deco XE75 v3, XE5300 v3.6, and WE10800 v3.6 firmware allows an adjacent attacker to impersonate a trusted mesh node without possessing any device-specific credential. Because the same private key is shared across all affected devices and embedded in firmware images that TP-Link publishes publicly on its download portal, the barrier to key extraction is low. No public exploit or active exploitation has been identified at time of analysis, but a vendor-released patch is available. | HIGH | 7.7 | 0.3% | 39 |
|
| CVE-2026-17251 | NULL pointer dereference in TP-Link TL-MR6400 v7's HTTP request parsing crashes the management daemon when an unauthenticated adjacent-network attacker sends a specially crafted request containing a malformed session cookie header. Successful exploitation results in a denial-of-service condition, disabling the web management interface and CGI functionality until service recovery - no confidentiality or integrity compromise is possible. No active exploitation has been confirmed (not in CISA KEV), no public proof-of-concept code has been reported, and a vendor patch is available. | HIGH | 7.1 | 0.3% | 36 |
|
| CVE-2026-75618 | Null pointer dereference in the RTSP service of TP-Link Tapo C100 V5 and C101 V5 IP cameras allows an unauthenticated attacker on the same local network segment to crash the video streaming service and trigger a full device reboot. The flaw is rooted in improper pointer validation during RTSP request parsing (CWE-476), with impact limited strictly to availability - no data exfiltration or configuration tampering is possible. A vendor-released firmware patch is available; no public exploit code or CISA KEV listing has been identified at the time of analysis. | HIGH | 7.1 | 0.2% | 36 |
|
| CVE-2026-17252 | Stack-based out-of-bounds write in the TP-Link TL-MR6400 v7 administrative web interface login handler allows an unauthenticated attacker with adjacent network access to crash the web management service by sending a specially crafted malformed HTTP request. The vulnerability (CWE-787) is confined to the login request parsing path and requires no authentication or user interaction, though exploitation is bounded by the adjacent network attack vector. Impact is limited to a denial-of-service condition - temporary loss of management interface access - with no confirmed confidentiality or integrity impact; no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog. | HIGH | 7.1 | 0.2% | 36 |
|
| CVE-2026-84941 | XML External Entity (XXE) injection in TP-Link Omada Controller's SAML SSO metadata parsing allows an authenticated user with SAML configuration privileges to read arbitrary files from the server, resulting in high-confidentiality information disclosure. The vulnerability arises because the controller does not disable external entity resolution when parsing user-supplied SAML metadata XML, enabling server-side file exfiltration. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available. | MEDIUM | 6.9 | 0.3% | 35 |
|