Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 632

Export CSV
CVE-2026-22223

Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and BE3600 v1

An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and BE3600 v1 (vpn modules) allows adjacent authenticated attacker execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.

CVSS 4.0 · 8.5 High EPSS 1.4% KEV · Not listed
Vendors
Tp-link
Products
Archer Be230 Archer Be230 Firmware
CVE-2026-22221

Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and BE3600 v1

An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) and BE3600 v1 allows adjacent authenticated attacker execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.

CVSS 4.0 · 8.5 High EPSS 1.4% KEV · Not listed
Vendors
Tp-link
Products
Archer Be230 Archer Be230 Firmware
CVE-2026-76653

Missing Authentication in VPN Configuration Management in TP-Link TL-MR6400 and Archer MR600

A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials. Successful exploitation may allow a remote unauthenticated attacker to disclose and modify VPN configuration information.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Archer Mr600 Tl-mr6400 V8
CVE-2026-76652

Authenticated Directory Traversal Vulnerability in File Upload Functionality in TP-Link TL-MR6400 and Archer MR600

An authenticated directory traversal vulnerability in file upload functionality has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8. Due to insufficient validation of user-supplied file information, an authenticated remote attacker with access to the affected upload functionality could upload a specially crafted file and cause it to be written outside the intended directory. Successful exploitation could allow an authenticated remote attacker to write files to unintended locations, potentially overwriting or modifying files accessible to the affected service; arbitrary code execution has not been demonstrated.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Archer Mr600 Tl-mr6400 V8
CVE-2026-84941

Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read

An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Oc2000 V1 Oc2000 V2 Oc200 V3 and 5 more
CVE-2026-75616

Command Injection in Router Web Management Interface

An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting in full device compromise. Successful exploitation may allow arbitrary command execution with elevated privileges, compromising the confidentiality, integrity, and availability of the affected device and network traffic passing through it.

CVSS 4.0 · 8.5 High EPSS 2.8% KEV · Not listed
Vendors
Tp-link
Products
Archer C20 Archer C20 Firmware Archer C20 V6
CVE-2026-15141

Referer Validation Bypass in TL-WR820N Web Management Interface

The web interface of the affected device relies on the HTTP referrer header as part of request validation.  Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficient validation logic. Successful exploitation may allow an adjacent attacker with access to the web management interface to obtain device configuration details and other sensitive information.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Td-w8961n Tl-wr820n Tl-wr820n Firmware
CVE-2026-19683

Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways

A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path.  Successful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link Tp-link Systems Inc
Products
Dr3150 Dr3150 Firmware Dr3150 V1 and 52 more
CVE-2026-9033

Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.  Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Dr3150 Dr3150 Firmware Dr3150 V1 and 52 more
CVE-2026-18167

Stack-based buffer overflow in TP-Link Archer AX55 v4

A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution on the device. Successful exploitation may cause the EasyMesh daemon to crash and may potentially allow remote code execution when Mesh mode is enabled. This may result in high impact to the confidentiality, integrity, and availability of the affected device.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Archer Ax55 V4
CVE-2026-15315

Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200

Tapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification module. An attacker on the local network can exploit weaknesses in challenge parameter validation to bypass normal authentication controls and obtain administrative session tokens. Successful exploitation may allow an attacker to subsequently execute privileged management actions, enable unauthorized administrative access and temporary disruption of device services, resulting in a denial-of-service (DoS) condition.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo C120 Tapo C120 Firmware Tapo C200 and 2 more
CVE-2026-75618

RTSP Null Pointer Dereference Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101

Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and device reboot. Successful exploitation can disrupt live video streaming functionality and cause a temporary denial-of-service condition.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo C100 Tapo C100 Firmware Tapo C100 V5 and 3 more
CVE-2026-75619

RTSP Heap Buffer Overflow Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101

Tapo C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, resulting in out-of-bounds heap writes. Successful exploitation can crash the RTSP service and trigger a device reboot, resulting in a temporary denial-of-service condition.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo C100 Tapo C100 Firmware Tapo C100 V5 and 3 more
CVE-2023-50224

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.

CVSS 3.1 · 6.5 Medium EPSS 20.0% KEV · Listed
Vendors
Tp-link
Products
Archer C1900 Archer C1900 Firmware Archer C5 and 69 more
CVE-2026-19586

Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways

A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.  Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device.

CVSS 4.0 · 9.3 Critical EPSS 5.8% KEV · Not listed
Vendors
Tp-link Tp-link Systems Inc
Products
Dr3150 Dr3150 Firmware Dr3150 V1 and 50 more
CVE-2026-8619

Unauthenticated Denial-of-Service Vulnerability in HTTP Service in TP-Link TL-MR100, TL-MR150, TL-MR6400 and Archer MR600

An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference.  A remote attacker on an adjacent network can send a specially crated HTTP request to trigger a crash of the HTTP service process. Successful exploitation may cause the HTTP service to crash, making the web management interface and HTTP-dependent functionality temporarily unavailable.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Archer Mr600 Archer Mr600 Firmware Tl-mr100 and 5 more
CVE-2026-75118

http_gdpr_decrypt Pre-Authentication Stack-Based Buffer Overflow

A pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt function of TL-MR100 V3.20 due to insufficient bounds checking of encrypted requests to the /cgi/login endpoint. An adjacent unauthenticated attacker with access to the router's web management interface can trigger memory corruption and potentially achieve arbitrary code execution. Successful exploitation can overwrite saved control-flow data on the httpd process stack prior to authentication, resulting in a service crash or potential arbitrary code execution in the context of the affected process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tl-mr100 V3.20
CVE-2026-76649

Pre-Authentication NULL Pointer Dereference in UPnP SOAP Action Request Processing in TP-Link TL-WR841N

A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP action requests. A specially crafted SOAP action request containing unexpected XML content may cause the UPnP daemon to terminate unexpectedly. Successful exploitation may result in a denial-of-service condition affecting UPnP functionality until the service is restarted or the device is rebooted.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tl-wr841n V14
CVE-2026-76650

Pre-Authentication NULL Pointer Dereference in UPnP SOAP State Variable Query Processing in TP-Link TL-WR841N

A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP state variable query requests. A specially crafted SOAP query may trigger unexpected termination or instability of the process hosting the UPnP service. Successful exploitation may result in a denial-of-service condition affecting UPnP discovery, state query, or related management functionality until the affected process is restarted or the device is rebooted.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tl-wr841n V14
CVE-2026-76651

Pre-Authentication Multipart Boundary Buffer Overflow in HTTP Service in TP-Link TL-WR841N

A buffer overflow vulnerability exists in the embedded HTTP service in TL-WR841N v14 when processing multipart/form-data requests. Insufficient validation of an attacker-controlled boundary parameter may allow a remote unauthenticated attacker to submit a crafted request that corrupts memory by overwriting data beyond the bounds of an internal buffer. Successful exploitation may result in modification or corruption of process memory, potentially leading to undefined application behavior. Arbitrary code execution, information disclosure, and denial-of-service conditions have not been demonstrated.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tl-wr841n V14