112
CVEs
0
Critical
78
High
0
KEV
3
PoC
32
Unpatched C/H
50.9%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
78
MEDIUM
32
LOW
1
Monthly CVE Trend
Affected Products (30)
Tl Wr886N Firmware
29
Tl Wr841n Firmware
24
Ex1200t Firmware
19
Tl Wr840N Firmware
16
X15 Firmware
16
Tl Wr940n Firmware
14
Archer Be230 Firmware
11
Ac1750 Firmware
11
Archer Ax53 Firmware
10
Tl Sg108E Firmware
9
Tapo
9
Omada Er605 Firmware
8
Tl Wdr7660 Firmware
8
M7350 Firmware
8
Tl Wr740N Firmware
8
T10 Firmware
7
Tl Er5120G Firmware
7
Tl War900L Firmware
6
Tl Wvr1750L Firmware
6
Nc250 Firmware
6
Tl Wr941Nd Firmware
6
Tl War450L Firmware
6
Tl War1750L Firmware
6
Tl Wvr450L Firmware
6
Tapo C520Ws V2 6
6
Tl Wvr458L Firmware
6
Tl War2600L Firmware
6
Tl Wvr1300L Firmware
6
Tl Wvr4300L Firmware
6
Tl War458L Firmware
6
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-15545 | The backup restore function does not properly validate unexpected or unrecognized tags within the backup file. When such a crafted file is restored, the injected tag is interpreted by a shell, allowing execution of arbitrary commands with root privileges. [CVSS 6.8 MEDIUM] | MEDIUM | 6.8 | 0.0% | 54 |
PoC
No patch
|
| CVE-2018-25321 | TP-Link TL-WR720N wireless router contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious web requests. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.3 | 0.0% | 47 |
PoC
No patch
|
| CVE-2025-14756 | Command injection vulnerability was found in the admin interface component of TP-Link Archer MR600 v5 firmware, allowing authenticated attackers to execute system commands with a limited character length via crafted input in the browser developer console, possibly leading to service disruption or full compromise. [CVSS 8.8 HIGH] | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-0652 | Authenticated attackers can execute arbitrary commands on TP-Link Tapo C260 v1 cameras through command injection in POST parameters during configuration synchronization, potentially achieving complete device compromise. The vulnerability stems from insufficient input validation and affects confidentiality, integrity, and availability with no patch currently available. | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2026-1457 | Remote code execution in TP-Link VIGI C385 cameras results from improper input validation in the Web API that allows authenticated attackers to trigger buffer overflows and corrupt memory. An attacker with valid credentials can exploit this vulnerability to execute arbitrary code with elevated privileges on affected devices. No patch is currently available for this high-severity issue. | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2025-15557 | An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept and modify encrypted device-cloud communications. [CVSS 8.8 HIGH] | HIGH | 8.8 | 0.0% | 44 |
No patch
|
| CVE-2025-13399 | Vx800V Firmware contains a vulnerability that allows attackers to high impact to confidentiality, integrity, and availability of transmitted data (CVSS 8.8). | HIGH | 8.8 | 0.0% | 44 |
No patch
|
| CVE-2026-11834 | Command injection in TP-Link Archer and TL-MR series routers allows an adjacent unauthenticated attacker on the same broadcast domain to execute arbitrary commands with elevated privileges by supplying crafted DHCP option responses. The flaw resides in DHCP client option processing during device initialization and is most reliably triggered when the router is in factory-default or unconfigured state. No public exploit identified at time of analysis, but the vendor (TP-Link) has confirmed the issue and released firmware patches. | HIGH | 8.7 | 0.4% | 44 |
|
| CVE-2026-15315 | Authentication bypass in TP-Link Tapo C200 v5 IP cameras running firmware below V5_1.4.6 Build 260709 Rel.27675n allows unauthenticated adjacent-network attackers to manipulate challenge parameters during the login handshake, circumventing the authentication verification module and obtaining valid administrative session tokens. With those tokens, an attacker can execute privileged management operations - including reconfiguring the camera, accessing live or recorded footage, and deliberately disrupting device services to cause a denial-of-service condition. No public exploit identified at time of analysis, and the adjacent-network requirement (AV:A) constrains exposure to attackers already present on the same LAN or Wi-Fi segment. | HIGH | 8.7 | 0.2% | 44 |
No patch
|
| CVE-2025-30237 | Authentication bypass in TP-Link Aginet home mesh networking devices allows an adjacent-network attacker without credentials to invoke privileged management operations and gain full administrative control of the device. The flaw (CWE-862, Missing Authorization) stems from inconsistent enforcement of access control checks on specific web management interface endpoints - certain privileged API handlers accept and act on requests without verifying caller identity. The vulnerability affects over 60 distinct model/region/hardware-revision combinations across the HB, HX, EX, HC, VX, and XX Aginet product lines; no public exploit code or CISA KEV listing is identified at time of analysis, but the vendor has released firmware patches. | HIGH | 8.7 | 0.2% | 44 |
|
| CVE-2026-76784 | Unauthorized device control of TP-Link Kasa smart home devices is achievable by any attacker with local network adjacency, due to missing required cryptographic protections (CWE-325) in the local LAN communication protocol. At least 20 distinct Kasa product models are affected, spanning smart plugs, power strips, outdoor outlets, and in-wall switches. Exploitation enables interception, replay, and forgery of device control messages with no authentication required, allowing complete operational manipulation or denial-of-service of affected hardware. | HIGH | 8.7 | 0.1% | 44 |
|
| CVE-2025-14300 | Missing authentication on the HTTPS connectAP interface in TP-Link Tapo C200 V3 firmware (versions 1.3.3 through 1.4.1) allows adjacent network attackers to remotely reconfigure device Wi-Fi settings, causing permanent denial-of-service until manual intervention. The vulnerability exploits CWE-306 (Missing Authentication for Critical Function) with CVSS 8.7 severity, requiring only adjacent network access with low attack complexity and no user interaction. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the technical barrier is minimal for LAN-positioned adversaries. | HIGH | 8.7 | 0.1% | 44 |
No patch
|
| CVE-2026-3294 | Administrative password reset in multiple TP-Link Wi-Fi range extenders (Archer RE650/RE305/RE360 v1, TL-WA860RE v4, RE580D v1) lets an unauthenticated attacker on the adjacent wireless/LAN network tamper with a login parameter to bypass authentication and take over the device. The flaw stems from insufficient validation of a client-supplied login parameter, yielding full admin control with no credentials or user interaction. There is no public exploit identified at time of analysis and EPSS is low (0.10%), but the vendor has released patched firmware. | HIGH | 8.7 | 0.1% | 44 |
|
| CVE-2026-34121 | TP-Link Tapo C520WS v2.6 contains an authentication bypass in its HTTP-based DS configuration service that allows unauthenticated attackers to execute privileged device configuration actions by appending authentication-exempt parameters to requests. The vulnerability stems from inconsistent JSON request parsing and authorization logic, enabling unauthorized modification of device state without requiring valid credentials. No public exploit code has been identified at time of analysis, and a vendor-released patch is available. | HIGH | 8.7 | 0.1% | 44 |
|
| CVE-2025-8065 | Stack-based buffer overflow in the ONVIF SOAP XML parser of TP-Link Tapo C200 v3 (firmware ≤1.4.1) and C520WS v2.6 cameras enables unauthenticated remote code execution from adjacent networks. Attackers can send crafted SOAP requests with oversized namespace prefixes to trigger memory corruption and achieve full device compromise with elevated privileges. EPSS probability and KEV status indicate no public exploit identified at time of analysis, though the vulnerability affects widely deployed consumer IoT cameras with network exposure. | HIGH | 8.7 | 0.0% | 44 |
No patch
|