13
CVEs
0
Critical
10
High
0
KEV
0
PoC
3
Unpatched C/H
76.9%
Patch Rate
0.6%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
10
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (30)
Tl Wr886N Firmware
29
Tl Wr841n Firmware
24
Ex1200t Firmware
19
Tl Wr840N Firmware
16
X15 Firmware
16
Tl Wr940n Firmware
14
Archer Be230 Firmware
11
Ac1750 Firmware
11
Archer Ax53 Firmware
10
Tl Sg108E Firmware
9
Tapo
9
Omada Er605 Firmware
8
Tl Wdr7660 Firmware
8
M7350 Firmware
8
Tl Wr740N Firmware
8
T10 Firmware
7
Tl Er5120G Firmware
7
Tl War900L Firmware
6
Tl Wvr1750L Firmware
6
Nc250 Firmware
6
Tl Wr941Nd Firmware
6
Tl War450L Firmware
6
Tl War1750L Firmware
6
Tl Wvr450L Firmware
6
Tapo C520Ws V2 6
6
Tl Wvr458L Firmware
6
Tl War2600L Firmware
6
Tl Wvr1300L Firmware
6
Tl Wvr4300L Firmware
6
Tl War458L Firmware
6
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-15315 | Authentication bypass in TP-Link Tapo C200 v5 IP cameras running firmware below V5_1.4.6 Build 260709 Rel.27675n allows unauthenticated adjacent-network attackers to manipulate challenge parameters during the login handshake, circumventing the authentication verification module and obtaining valid administrative session tokens. With those tokens, an attacker can execute privileged management operations - including reconfiguring the camera, accessing live or recorded footage, and deliberately disrupting device services to cause a denial-of-service condition. No public exploit identified at time of analysis, and the adjacent-network requirement (AV:A) constrains exposure to attackers already present on the same LAN or Wi-Fi segment. | HIGH | 8.7 | 0.2% | 44 |
No patch
|
| CVE-2026-76784 | Unauthorized device control of TP-Link Kasa smart home devices is achievable by any attacker with local network adjacency, due to missing required cryptographic protections (CWE-325) in the local LAN communication protocol. At least 20 distinct Kasa product models are affected, spanning smart plugs, power strips, outdoor outlets, and in-wall switches. Exploitation enables interception, replay, and forgery of device control messages with no authentication required, allowing complete operational manipulation or denial-of-service of affected hardware. | HIGH | 8.7 | 0.1% | 44 |
|
| CVE-2026-78541 | Stored OS command injection in the TP-Link Archer BE3600 V1 parent-control module allows an authenticated administrative attacker on the adjacent network to achieve arbitrary command execution on the device. The payload is persisted at configuration time-embedded in a crafted profile name-and fires asynchronously when the router's daily cloud report generation job runs, without any further attacker interaction. A vendor-released patch is available from TP-Link; no public exploit has been identified at time of analysis. | HIGH | 8.5 | 1.0% | 43 |
|
| CVE-2026-16348 | Root-level command injection in the TP-Link Archer BE800 V1 router (firmware prior to 1.4.2 Build 260708) allows an authenticated administrator on an adjacent network to execute arbitrary OS commands with root privileges by injecting shell metacharacters through the VPN connection interface. Successful exploitation hands an attacker full control of the embedded Linux environment, enabling persistent backdoors, credential theft, and use of the router as a pivot into the connected LAN. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released firmware patch is available. | HIGH | 8.5 | 0.9% | 43 |
|
| CVE-2026-80712 | The spi-qpic-snand NAND flash driver in Linux kernel 6.18 and later contains a command-ordering defect that causes every SET_FEATURE write to apply the previous operation's value rather than the intended one, producing an off-by-one effect. On Qualcomm IPQ5018-based hardware (confirmed on TP-Link Archer AX55 v1 with ESMT F50L1G41LB flash), this defect became destructive in v6.18 when SPI-NAND OTP support was introduced: the 'disable OTP mode' call erroneously leaves CFG_OTP_ENABLE set permanently, causing all subsequent flash reads to return OTP area content and all writes to fail with -EIO, rendering the device unbootable. No public exploit identified at time of analysis; EPSS of 0.15% (5th percentile) correctly reflects that this is a driver logic defect rather than a traditionally attacker-controllable vulnerability. | HIGH | 8.4 | 0.2% | 42 |
|
| CVE-2026-17176 | OS command injection in TP-Link Deco BE11000 V2's TDDP (TP-Link Device Debug Protocol) module enables unauthenticated adjacent-network attackers to execute arbitrary commands with root privileges by sending a single crafted UDP packet. The vulnerability results in complete device compromise, covering unauthorized command execution, configuration modification, and total loss of confidentiality, integrity, and availability. A vendor firmware patch is available via the TP-Link support page; no public exploit has been identified at time of analysis. | HIGH | 7.7 | 3.6% | 42 |
|
| CVE-2026-18167 | Stack-based buffer overflow in the EasyMesh daemon of the TP-Link Archer AX55 v4 allows a LAN-adjacent unauthenticated attacker to crash the easymesh process and potentially achieve remote code execution on the router, provided Mesh mode is enabled. The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N) correctly constrains the attack to the local network segment with high complexity due to the Mesh mode prerequisite. TP-Link has released a patched firmware; no public exploit code or active exploitation has been identified at time of analysis. | HIGH | 7.7 | 0.3% | 39 |
|
| CVE-2026-8619 | Unauthenticated denial-of-service in TP-Link TL-MR100, TL-MR150, TL-MR6400, and Archer MR600 routers allows an adjacent-network attacker to crash the HTTP management service by sending a specially crafted HTTP request that triggers a NULL pointer dereference (CWE-476). Exploitation requires only network adjacency and no credentials, resulting in the web management interface and any HTTP-dependent functionality becoming temporarily unavailable until the service restarts. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the low attack complexity makes this straightforward to trigger for any attacker already on the local or adjacent network. | HIGH | 7.1 | 0.3% | 36 |
No patch
|
| CVE-2026-15316 | Denial-of-service in TP-Link Tapo C200 v5 IP cameras allows adjacent-network unauthenticated attackers to crash the device's configuration service by submitting oversized encrypted ciphertext payloads that trigger unhandled exceptions. Affected firmware versions prior to V5_1.4.6 Build 260709 Rel.27675n are confirmed vulnerable per ENISA EUVD-2026-62194; successful exploitation temporarily disables HTTPS management and monitoring until the service self-recovers, with no confidentiality or integrity impact. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-17252 | Stack-based out-of-bounds write in the TP-Link TL-MR6400 v7 administrative web interface login handler allows an unauthenticated attacker with adjacent network access to crash the web management service by sending a specially crafted malformed HTTP request. The vulnerability (CWE-787) is confined to the login request parsing path and requires no authentication or user interaction, though exploitation is bounded by the adjacent network attack vector. Impact is limited to a denial-of-service condition - temporary loss of management interface access - with no confirmed confidentiality or integrity impact; no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog. | HIGH | 7.1 | 0.2% | 36 |
|
| CVE-2026-81531 | Unauthenticated information disclosure in TP-Link Omada Controller exposes an initialization API endpoint that remains reachable after setup completes, leaking account-related data to any remote unauthenticated user. The endpoint was designed for one-time use during initial controller configuration but lacks post-initialization access controls, allowing attackers to query it freely. Successful exploitation facilitates user enumeration, which can serve as a reconnaissance step toward credential-stuffing or targeted brute-force attacks against administrative accounts. No public exploit or CISA KEV listing is identified at time of analysis. | MEDIUM | 6.9 | 0.4% | 34 |
|
| CVE-2026-19683 | Cleartext transmission of DDNS authentication credentials in TP-Link Omada business gateway routers exposes sensitive account information to network-positioned attackers. Nineteen distinct hardware models spanning the ER and DR product lines are affected, including the ER605, ER7206, ER8411, and multiple 4G outdoor variants. An attacker with visibility or control over the network path between the gateway and an external DDNS provider can intercept credentials and potentially hijack DDNS management - enabling unauthorized DNS record manipulation for the affected deployment. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog. | MEDIUM | 6.3 | 0.3% | 32 |
|
| CVE-2026-18330 | Hard-coded RSA private key exposure in the TP-Link Archer AX55 v4 web module allows a LAN-adjacent attacker who captures HTTP login traffic to decrypt the administrator password, since the shared private key is identical across all units of this model and the AES session key is additionally weakened. All Archer AX55 v4 firmware versions appear affected per the CPE wildcard, with a vendor patch now available via TP-Link's firmware portal. No public exploit code has been identified at time of analysis, though the cryptographic flaw is deterministic - once the static key is extracted from firmware, any captured login session can be decrypted offline. | MEDIUM | 6.1 | 0.2% | 31 |
|