50
CVEs
0
Critical
37
High
0
KEV
2
PoC
3
Unpatched C/H
90.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
37
MEDIUM
13
LOW
0
Monthly CVE Trend
Affected Products (30)
Tl Wr886N Firmware
29
Tl Wr841n Firmware
24
Ex1200t Firmware
19
Tl Wr840N Firmware
16
X15 Firmware
16
Tl Wr940n Firmware
14
Archer Be230 Firmware
11
Ac1750 Firmware
11
Archer Ax53 Firmware
10
Tl Sg108E Firmware
9
Tapo
9
Omada Er605 Firmware
8
Tl Wdr7660 Firmware
8
M7350 Firmware
8
Tl Wr740N Firmware
8
T10 Firmware
7
Tl Er5120G Firmware
7
Tl War900L Firmware
6
Tl Wvr1750L Firmware
6
Nc250 Firmware
6
Tl Wr941Nd Firmware
6
Tl War450L Firmware
6
Tl War1750L Firmware
6
Tl Wvr450L Firmware
6
Tapo C520Ws V2 6
6
Tl Wvr458L Firmware
6
Tl War2600L Firmware
6
Tl Wvr1300L Firmware
6
Tl Wvr4300L Firmware
6
Tl War458L Firmware
6
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2018-25321 | TP-Link TL-WR720N wireless router contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious web requests. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.3 | 0.0% | 47 |
PoC
No patch
|
| CVE-2026-11834 | Command injection in TP-Link Archer and TL-MR series routers allows an adjacent unauthenticated attacker on the same broadcast domain to execute arbitrary commands with elevated privileges by supplying crafted DHCP option responses. The flaw resides in DHCP client option processing during device initialization and is most reliably triggered when the router is in factory-default or unconfigured state. No public exploit identified at time of analysis, but the vendor (TP-Link) has confirmed the issue and released firmware patches. | HIGH | 8.7 | 0.4% | 44 |
|
| CVE-2026-15315 | Authentication bypass in TP-Link Tapo C200 v5 IP cameras running firmware below V5_1.4.6 Build 260709 Rel.27675n allows unauthenticated adjacent-network attackers to manipulate challenge parameters during the login handshake, circumventing the authentication verification module and obtaining valid administrative session tokens. With those tokens, an attacker can execute privileged management operations - including reconfiguring the camera, accessing live or recorded footage, and deliberately disrupting device services to cause a denial-of-service condition. No public exploit identified at time of analysis, and the adjacent-network requirement (AV:A) constrains exposure to attackers already present on the same LAN or Wi-Fi segment. | HIGH | 8.7 | 0.2% | 44 |
No patch
|
| CVE-2025-30237 | Authentication bypass in TP-Link Aginet home mesh networking devices allows an adjacent-network attacker without credentials to invoke privileged management operations and gain full administrative control of the device. The flaw (CWE-862, Missing Authorization) stems from inconsistent enforcement of access control checks on specific web management interface endpoints - certain privileged API handlers accept and act on requests without verifying caller identity. The vulnerability affects over 60 distinct model/region/hardware-revision combinations across the HB, HX, EX, HC, VX, and XX Aginet product lines; no public exploit code or CISA KEV listing is identified at time of analysis, but the vendor has released firmware patches. | HIGH | 8.7 | 0.2% | 44 |
|
| CVE-2026-76784 | Unauthorized device control of TP-Link Kasa smart home devices is achievable by any attacker with local network adjacency, due to missing required cryptographic protections (CWE-325) in the local LAN communication protocol. At least 20 distinct Kasa product models are affected, spanning smart plugs, power strips, outdoor outlets, and in-wall switches. Exploitation enables interception, replay, and forgery of device control messages with no authentication required, allowing complete operational manipulation or denial-of-service of affected hardware. | HIGH | 8.7 | 0.1% | 44 |
|
| CVE-2026-3294 | Administrative password reset in multiple TP-Link Wi-Fi range extenders (Archer RE650/RE305/RE360 v1, TL-WA860RE v4, RE580D v1) lets an unauthenticated attacker on the adjacent wireless/LAN network tamper with a login parameter to bypass authentication and take over the device. The flaw stems from insufficient validation of a client-supplied login parameter, yielding full admin control with no credentials or user interaction. There is no public exploit identified at time of analysis and EPSS is low (0.10%), but the vendor has released patched firmware. | HIGH | 8.7 | 0.1% | 44 |
|
| CVE-2026-34121 | TP-Link Tapo C520WS v2.6 contains an authentication bypass in its HTTP-based DS configuration service that allows unauthenticated attackers to execute privileged device configuration actions by appending authentication-exempt parameters to requests. The vulnerability stems from inconsistent JSON request parsing and authorization logic, enabling unauthorized modification of device state without requiring valid credentials. No public exploit code has been identified at time of analysis, and a vendor-released patch is available. | HIGH | 8.7 | 0.1% | 44 |
|
| CVE-2025-30241 | OS command injection in TP-Link Aginet home networking devices (HB, EB, EX, XX, VX series) allows an authenticated attacker on the same network segment to execute arbitrary operating system commands with elevated privileges through unsanitized web interface inputs. The attack vector is adjacent-network only (AV:A per CVSS 4.0), limiting internet-scale exploitation, but a compromised or malicious LAN/Wi-Fi client could fully compromise the affected device. No public exploit code or CISA KEV listing has been identified at time of analysis; TP-Link has released patched firmware across all affected product lines. | HIGH | 8.6 | 0.5% | 43 |
|
| CVE-2026-9044 | OS command injection in the VPN module of TP-Link Archer AXE75 V1 routers allows an adjacent, authenticated attacker with administrator-level access to achieve full device compromise by importing a specially crafted VPN client configuration file. Improper filtering of special characters (CWE-78) in configuration input permits injection of arbitrary OS commands, granting an attacker complete control over the device including configuration integrity, network routing, and service availability. No public exploit identified at time of analysis; vendor-released patch is available. | HIGH | 8.5 | 1.0% | 43 |
|
| CVE-2026-78541 | Stored OS command injection in the TP-Link Archer BE3600 V1 parent-control module allows an authenticated administrative attacker on the adjacent network to achieve arbitrary command execution on the device. The payload is persisted at configuration time-embedded in a crafted profile name-and fires asynchronously when the router's daily cloud report generation job runs, without any further attacker interaction. A vendor-released patch is available from TP-Link; no public exploit has been identified at time of analysis. | HIGH | 8.5 | 1.0% | 43 |
|
| CVE-2026-16348 | Root-level command injection in the TP-Link Archer BE800 V1 router (firmware prior to 1.4.2 Build 260708) allows an authenticated administrator on an adjacent network to execute arbitrary OS commands with root privileges by injecting shell metacharacters through the VPN connection interface. Successful exploitation hands an attacker full control of the embedded Linux environment, enabling persistent backdoors, credential theft, and use of the router as a pivot into the connected LAN. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released firmware patch is available. | HIGH | 8.5 | 0.9% | 43 |
|
| CVE-2025-30238 | Privilege escalation across more than 60 TP-Link Aginet mesh networking device models allows authenticated low-privileged users to invoke administrative operations - including creating privileged accounts and modifying critical configuration settings - by exploiting insufficient authorization validation (CWE-863). The flaw spans the HB, HX, EX, HC, EB, XX, VX, and XC device families in US, EU, BR, AU, CA, KR, DE, and RU regional variants, with specific vulnerable firmware builds documented per device in ENISA EUVD-2025-210674. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available at the TP-Link advisory. | HIGH | 8.6 | 0.1% | 43 |
|
| CVE-2025-15517 | A missing authentication check in the HTTP server of TP-Link Archer NX-series routers (NX200, NX210, NX500, NX600) allows unauthenticated attackers to access privileged CGI endpoints intended for authenticated administrators. An attacker can perform critical operations including firmware upload and configuration changes without providing valid credentials, effectively gaining administrative control over the device. A vendor patch is available, and this vulnerability represents a direct authentication bypass with severe real-world exploitation potential. | HIGH | 8.6 | 0.0% | 43 |
|
| CVE-2026-30818 | OS command injection in TP-Link Archer AX53 v1.0 dnsmasq module allows authenticated adjacent attackers to execute arbitrary code through maliciously crafted configuration files. Successful exploitation enables device configuration modification, sensitive data access, and complete system compromise. Affects TP-Link Archer AX53 v1.0 firmware versions prior to 1.7.1 Build 20260213. Requires high-privilege adjacent network access (CVSS:4.0 AV:A/PR:H). No public exploit identified at time of analysis. | HIGH | 8.5 | 0.4% | 43 |
|
| CVE-2026-30815 | OS command injection in TP-Link Archer AX53 v1.0 OpenVPN module allows authenticated adjacent attackers to execute arbitrary system commands through maliciously crafted configuration files. Exploitation requires high-privilege adjacency access but enables complete device compromise including configuration modification, credential disclosure, and persistent backdoor installation. Affects AX53 v1.0 firmware prior to 1.7.1 Build 20260213. No public exploit identified at time of analysis. | HIGH | 8.5 | 0.3% | 43 |
|