Export limit exceeded: 21742 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 632

Export CSV
CVE-2026-109683

UPnP Newline Injection Vulnerability in TP-Link Archer BE805

A newline injection vulnerability exists in the UPnP service of Archer BE805 v1 such that an adjacent attacker can supply newline characters in a UPnP port-mapping description due to improper sanitization, resulting in possible injection of unintended content into UPnP port-mapping data. Successful exploitation may allow an unauthenticated attacker on the local network to modify runtime UPnP port-mapping information and create spoofed entries within the affected service. The issue is limited to the integrity of UPnP mapping data and does not demonstrate code execution or privilege escalation.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Archer Be805 V1
CVE-2026-105821

Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT Proxy

The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo devices to request service tokens. The broker does not verify that the device ID supplied in a proxy request belongs to the authenticated device. An attacker who owns a Tapo device and knows another device's ID may obtain a device token scoped to the target device and use it to upload attacker-controlled content to the target user's Tapo Cloud storage. The content may then be presented in the Tapo app as a legitimate event. Successful exploitation may allow an attacker to upload attacker-controlled content that is presented to a target user as a legitimate Tapo event, retrieve internal service information through crafted proxy requests, or abuse Tapo Cloud outbound request capability in activity that could affect service availability.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo Cloud Service
CVE-2026-105822

Server-Side Request Forgery in Tapo Cloud MQTT Proxy

The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a user-controlled host value without sufficient input validation. An attacker may exploit this vulnerability to cause the Tapo Cloud service to send requests to an attacker-controlled server. Successful exploitation may cause the Tapo Cloud service to send a request to an attacker-controlled server, exposing the internal information and causing potential Distributed Denial-of-Service (DDoS).

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo Cloud Service
CVE-2026-102816

Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305

An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on the same local network may modify the wireless regulatory region and force the device to reapply its wireless configuration.  Successful exploitation may cause wireless connection interruptions, unavailable channels, client disconnections, or wireless service instability, and may cause the device to apply parameters intended for a different regulatory region.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Re305
CVE-2026-102813

Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305

An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code. Because the interface lacks an effective attempt counter or lockout mechanism and uses a predictable verification-code generation process, an attacker may obtain or brute-force the code and reset the administrator password.  Successful exploitation may allow an unauthenticated attacker on the local network to reset the administrator password and subsequently access privileged device-management functions.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Re305
CVE-2026-102812

Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7

A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and initialization vector are embedded in the firmware configuration-management component. An attacker who obtains an affected configuration backup file may extract the cryptographic material from the firmware and use it to decrypt the backup.  Successful exploitation may disclose sensitive configuration information contained in a backup file, including administrator passwords and Wi-Fi credentials.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Archer C20 V5 Re305
CVE-2026-8913

Command Injection in Archer MR600 WireGuard Client Configuration

A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v2, v3, and v5 due to improper neutralization of user-controlled input within the web management interface. An authenticated attacker with administrative privileges may be able to execute arbitrary commands when applying configuration changes.Successful exploitation may result in a full compromise of confidentiality, integrity, and availability of the affected device.

CVSS 4.0 · 8.5 High EPSS 1.1% KEV · Not listed
Vendors
Tp-link
Products
Archer Mr600
CVE-2026-34121

Authentication Bypass in DS Configuration Service via HTTP Request Parsing Differential of TP-Link Tapo C520WS and C210

An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 and C210 v3 was identified, due to inconsistent parsing and authorization logic in JSON requests during authentication check. An unauthenticated attacker can append an authentication-exempt action to a request containing privileged DS do actions, bypassing authorization checks. Successful exploitation allows unauthenticated execution of restricted configuration actions, which may result in unauthorized modification of device state.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo C520ws Tapo C520ws Firmware Tapo C520ws V2
CVE-2026-34118

Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in multiple TP-Link Tapo Cameras

A heap-based buffer overflow vulnerability was identified in multiple TP-Link Tapo cameras in the HTTP POST body parsing logic due to missing validation of remaining buffer capacity after dynamic allocation, due to insufficient boundary validation when handling externally supplied HTTP input.   An attacker on the same network segment could trigger heap memory corruption conditions by sending crafted payloads that cause write operations beyond allocated buffer boundaries.  Successful exploitation causes a Denial-of-Service (DoS) condition, causing the device’s process to crash or become unresponsive.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo C520ws Tapo C520ws Firmware Tapo C520ws V2
CVE-2026-89052

Hardcoded AES encryption key in Archer C6

A hardcoded cryptographic key management vulnerability exists in Archer C6 due to the use of a universal cryptographic key shared across devices. An attacker who obtains an encrypted configuration file or other protected credential data can recover plaintext credentials.  Successful exploitation may allow unauthorized disclosure of sensitive information, including administrative credentials.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Archer C6
CVE-2026-100420

Information disclosure vulnerability in the cloud-client daemon of Deco BE63

A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password.  Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Deco Be63
CVE-2026-102815

Command Injection in tmpServer Allows Local Privilege Escalation in TP-Link RE305

An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process on the device may submit a crafted request to the TDDPv1 service and execute operating-system commands with root privileges. Successful exploitation may allow a local attacker with low privileges to obtain root privileges and execute arbitrary operating-system commands on the affected device.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Re305
CVE-2026-102814

Improper Authentication in TP-Link TDDP v2 Allows Root Command Execution in TP-Link RE305

An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets and access privileged TDDP operations, including functionality that can lead to operating-system command execution when the TDDP service is running and accessible. Successful exploitation may allow an unauthenticated attacker on the same local area network to execute arbitrary system commands with root privileges.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Re305
CVE-2026-0631

Authenticated Command Injection Vulnerability in Surfshark VPN Login in multiple Archer products

An OS Command Injection vulnerability exists in the Surfshark VPN login functionality in TP-Link Archer BE230 v1.2, BE3600v1, AX10 v3 and AXE75 v1, allowing an adjacent authenticated attacker to execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420 and Archer AXE75 v1 < 1.5.6 Build 20260623.

CVSS 4.0 · 8.5 High EPSS 1.6% KEV · Not listed
Vendors
Tp-link
Products
Archer Be230 Archer Be230 Firmware
CVE-2026-18330

Hardcoded Shared RSA-1024 Private Key in Web Login in TP-Link RE305 and Archer C7

A hard-coded cryptographic key vulnerability exists in TP-Link RE305 V3 and Archer C7 V5. The same RSA-1024 private key is stored within firmware configuration files and reused across devices. An attacker who obtains the private key and captures an HTTP Web UI login session may use the key to decrypt the administrator password.  Successful exploitation may disclose the administrator password captured from an HTTP login session and compromise session confidentiality.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Archer Ax55 V4
CVE-2026-15316

Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200

An improper input validation vulnerability in the configuration service for processing encrypted credential data has been identified in Tapo C200 v5.  An attacker can send oversized crypted ciphertext values that may trigger exception handling failures, due to insufficient validation, causing the affected device to crash or restart. Successful exploitation may temporarily disrupt HTTPS management and monitoring functionality, resulting in a denial-of-service (DoS) condition until the service recovers.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo C200 Tapo C200 Firmware Tapo C200 V5
CVE-2026-102298

Insufficient Authorization and User Boundary Validation in Omada Controller MSP

In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid passwords, and successful authentication.  Successful exploitation may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Software Controller
CVE-2025-62501

SSH Hostkey Misconfiguration Vulnerability in Archer Devices

SSH Hostkey misconfiguration vulnerability in Archer AX53 and Archer BE3600 (tmpserver modules) allows attackers to obtain device credentials through a specially crafted man‑in‑the‑middle (MITM) attack. This could enable unauthorized access if captured credentials are reused.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Archer Ax53 Archer Ax53 Firmware
CVE-2026-105810

Authenticated Local Stack Overflow in TP-Link Tapo C320WS

Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path. An authenticated attacker on the adjacent network can submit a crafted request containing an oversized encrypted password field, overwrite stack state, and execute commands with root privileges. Successful exploitation may allow an authenticated adjacent-network attacker to take control of the affected camera, modify camera behavior, access sensitive local configuration, and disrupt device availability.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo C320ws
CVE-2026-105814

Order-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210

TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera operations, including pan-tilt-zoom control, to be executed without a valid authenticated session.  Successful exploitation may allow an unauthenticated attacker on the adjacent network to perform protected camera operations, including pan-tilt-zoom (PTZ) control, without a valid authenticated session. This could result in unauthorized manipulation of camera functionality.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo C210