51
CVEs
1
Critical
28
High
0
KEV
2
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
28
MEDIUM
22
LOW
0
Monthly CVE Trend
Affected Products (30)
Omada Access Points
7
Omada Gateways
7
Omada Switches
7
Tapo C520Ws V2
6
Tapo C520Ws V2 6
6
Ex220 Eu1 V1 0 1 20
5
Xx530V Eu1
5
Vx800V De V1 0
5
Ax53 V1 0
5
Hb610 Ca V2 0
5
Hb210 Pro Eu1 1 0
5
Ex920 Us2 V1 6 V1 0
5
Hb710 Eu1 1 0
5
Ex220 Br V1 0 1 20 1 28 1 29 1 8
5
Hb710 Us2 V1 6 1 0
5
Hb810 Eu1 V2 0
5
Ex220 Ru V1 0
5
Hb610 Us2 V2 6 2 0
5
Hb410 Eu1 1 0
5
Omada Controllers
5
Ex220 Us1 V1 0
5
Ex220 Br V2 0
5
Ex820V Eu1 V1 0
5
Ex222 Kr V1 0
5
Hb210 Us2 1 0
5
Xx530V Br V2 0
5
Ex222 Us1 V1 0
5
Ex222 Eu1 V1 0
5
Hb210 Pro Us2 1 0 1 6
5
Hb210 Eu1 1 0
5
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-19586 | Pre-authentication OS command injection in TP-Link Omada gateways (ER-series and DR-series VPN routers) lets an unauthenticated remote attacker execute arbitrary commands when the device is configured as an OpenVPN Server, because client-supplied data is insufficiently validated during OpenVPN connection establishment before authentication completes. Successful exploitation can yield full device compromise (CVSS 4.0 9.3, CWE-78). No public exploit has been identified at time of analysis, and the flaw was reported by the vendor (TP-Link) itself. | CRITICAL | 9.3 | 5.0% | 52 |
|
| CVE-2026-9254 | Unauthenticated OS command injection in TP-Link Archer BE800 V1, BE3600 V1, and AX75 V1 routers allows any LAN-adjacent attacker to execute arbitrary commands with root privileges via the parental control subsystem. Exploitation requires no credentials and no user interaction, resulting in complete device compromise including full control over routing, firewall policy, and all traffic transiting the device. Vendor-released firmware patches are available for all three affected models; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.7 | 2.3% | 46 |
|
| CVE-2026-12935 | Remote code execution and denial-of-service in the TP-Link TL-WR940N v6 router stem from a stack-based buffer overflow in the kernel-resident RTSP connection-tracking (ALG) module. An attacker who lures a LAN-side client into connecting to an attacker-controlled RTSP server can send a crafted RTSP message that the router's kernel helper mishandles, potentially yielding full device compromise. The flaw is exploitable by an unauthenticated attacker against the router's default configuration; no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 8.7 | 0.8% | 44 |
|
| CVE-2026-11834 | Command injection in TP-Link Archer and TL-MR series routers allows an adjacent unauthenticated attacker on the same broadcast domain to execute arbitrary commands with elevated privileges by supplying crafted DHCP option responses. The flaw resides in DHCP client option processing during device initialization and is most reliably triggered when the router is in factory-default or unconfigured state. No public exploit identified at time of analysis, but the vendor (TP-Link) has confirmed the issue and released firmware patches. | HIGH | 8.7 | 0.4% | 44 |
|
| CVE-2026-75118 | Stack-based buffer overflow in TP-Link TL-MR100 V3.20 allows an adjacent unauthenticated attacker to corrupt the httpd process stack by sending a crafted encrypted payload to the /cgi/login endpoint before any authentication occurs. The flaw resides in the http_gdpr_decrypt function, which performs insufficient bounds checking on incoming data, enabling overwrite of saved control-flow data and potential arbitrary code execution in the context of the httpd process. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.7 | 0.2% | 44 |
|
| CVE-2025-30237 | Authentication bypass in TP-Link Aginet home mesh networking devices allows an adjacent-network attacker without credentials to invoke privileged management operations and gain full administrative control of the device. The flaw (CWE-862, Missing Authorization) stems from inconsistent enforcement of access control checks on specific web management interface endpoints - certain privileged API handlers accept and act on requests without verifying caller identity. The vulnerability affects over 60 distinct model/region/hardware-revision combinations across the HB, HX, EX, HC, VX, and XX Aginet product lines; no public exploit code or CISA KEV listing is identified at time of analysis, but the vendor has released firmware patches. | HIGH | 8.7 | 0.2% | 44 |
|
| CVE-2026-76784 | Unauthorized device control of TP-Link Kasa smart home devices is achievable by any attacker with local network adjacency, due to missing required cryptographic protections (CWE-325) in the local LAN communication protocol. At least 20 distinct Kasa product models are affected, spanning smart plugs, power strips, outdoor outlets, and in-wall switches. Exploitation enables interception, replay, and forgery of device control messages with no authentication required, allowing complete operational manipulation or denial-of-service of affected hardware. | HIGH | 8.7 | 0.1% | 44 |
|
| CVE-2026-75616 | OS command injection in the TP-Link Archer C20 v6 web management interface enables an authenticated administrator to execute arbitrary system commands by submitting crafted WAN configuration inputs that bypass insufficient input validation. Full device compromise - confidentiality, integrity, and availability - is achievable for all traffic routed through the affected device. TP-Link has released a patched firmware; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.5 | 1.1% | 44 |
|
| CVE-2026-15427 | Root-level OS command injection in the TR-069/CWMP management client of the TP-Link Archer VX1800v v1 gateway lets an attacker who controls (or has compromised) the ACS provisioning server inject unsanitized parameters that the device executes as system-level commands. Because CWMP provisioning is trusted implicitly, a malicious or hijacked ACS can push crafted values that yield arbitrary command execution as root and full device takeover. No public exploit identified at time of analysis, and the flaw was reported by TP-Link itself; a firmware fix is available. | HIGH | 8.6 | 0.5% | 44 |
|
| CVE-2025-30241 | OS command injection in TP-Link Aginet home networking devices (HB, EB, EX, XX, VX series) allows an authenticated attacker on the same network segment to execute arbitrary operating system commands with elevated privileges through unsanitized web interface inputs. The attack vector is adjacent-network only (AV:A per CVSS 4.0), limiting internet-scale exploitation, but a compromised or malicious LAN/Wi-Fi client could fully compromise the affected device. No public exploit code or CISA KEV listing has been identified at time of analysis; TP-Link has released patched firmware across all affected product lines. | HIGH | 8.6 | 0.5% | 43 |
|
| CVE-2026-9044 | OS command injection in the VPN module of TP-Link Archer AXE75 V1 routers allows an adjacent, authenticated attacker with administrator-level access to achieve full device compromise by importing a specially crafted VPN client configuration file. Improper filtering of special characters (CWE-78) in configuration input permits injection of arbitrary OS commands, granting an attacker complete control over the device including configuration integrity, network routing, and service availability. No public exploit identified at time of analysis; vendor-released patch is available. | HIGH | 8.5 | 1.0% | 43 |
|
| CVE-2026-78541 | Stored OS command injection in the TP-Link Archer BE3600 V1 parent-control module allows an authenticated administrative attacker on the adjacent network to achieve arbitrary command execution on the device. The payload is persisted at configuration time-embedded in a crafted profile name-and fires asynchronously when the router's daily cloud report generation job runs, without any further attacker interaction. A vendor-released patch is available from TP-Link; no public exploit has been identified at time of analysis. | HIGH | 8.5 | 1.0% | 43 |
|
| CVE-2026-16348 | Root-level command injection in the TP-Link Archer BE800 V1 router (firmware prior to 1.4.2 Build 260708) allows an authenticated administrator on an adjacent network to execute arbitrary OS commands with root privileges by injecting shell metacharacters through the VPN connection interface. Successful exploitation hands an attacker full control of the embedded Linux environment, enabling persistent backdoors, credential theft, and use of the router as a pivot into the connected LAN. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released firmware patch is available. | HIGH | 8.5 | 0.9% | 43 |
|
| CVE-2026-15428 | OS command injection in the TP-Link Archer VX1800v (v1) router lets an adjacent, high-privileged attacker inject shell metacharacters through the domain name parameter of an HTTP management interface, yielding arbitrary command execution as root and full device takeover. The flaw scores CVSS 4.0 8.5 (High) and a vendor firmware patch is available; no public exploit identified at time of analysis. Note a naming discrepancy in the source data - the free-text description says 'VX800v' while the CPE and tags reference 'VX1800V' - so verify the exact affected model against the TP-Link advisory before acting. | HIGH | 8.5 | 0.9% | 43 |
|
| CVE-2026-9770 | Use of a hard-coded, device-shared cryptographic private key in TP-Link Kasa EC71 v4 and EC70 v4 camera firmware lets an adjacent-network attacker impersonate the device's web management service and break its transport encryption. Because the same private key is baked into every unit's read-only filesystem, anyone who extracts it from one firmware image can passively decrypt or actively man-in-the-middle traffic to any other device on the local network without authentication. TP-Link (the reporting vendor) has released fixed firmware; there is no public exploit identified at time of analysis and the CVE is not in CISA KEV. | HIGH | 8.6 | 0.2% | 43 |
PoC
|