Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 632

Export CSV
CVE-2026-12339

Authenticated Arbitrary File Write Vulnerability in multiple devices

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Archer Mr200 V07 Archer Mr600 V2 Tl-mr6400 V5.3
CVE-2026-15469

Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800

The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6.  A shared RSA-512 mesh group private key is present in the affected firmware and is used by the mesh protocol for node authentication.  An attacker who obtains the firmware image and has local network access may be able to authenticate as a mesh node without possessing a device-specific credential. Successful exploitation may allow an unauthenticated adjacent attacker to impersonate a trusted mesh node and bypass mesh node authentication, which may permit unauthorized changes to device or mesh configuration, affecting confidentiality, integrity and availability.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Deco Xe75 V3 We10800 V3.6 Xe5300 V3.6
CVE-2026-9254

Command Injection Vulnerability in Parent Control of Multiple TP-Link Archer Devices

An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inject arbitrary commands and execute them with root privileges. Successful exploitation may result in complete device compromise and impact the confidentiality, integrity, and availability of the affected device and network traffic.

CVSS 4.0 · 8.7 High EPSS 3.1% KEV · Not listed
Vendors
Tp-link
Products
Archer Ax75 V1 Archer Be3600 V1 Archer Be800 V1
CVE-2026-16348

Command Injection Vulnerability in VPN connection of Archer BE800

An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection.  Successful exploitation may enable persistent backdoors, credential theft, LAN reconnaissance, and router-assisted attacks against connected devices.

CVSS 4.0 · 8.5 High EPSS 2.1% KEV · Not listed
Vendors
Tp-link
Products
Archer Be800 V1
CVE-2026-78541

Command Injection in Parent Control of TP-Link Archer BE3600 v1

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report generation and may result in arbitrary command execution. Successful exploitation may allow command execution on the affected device with potential impact to device confidentiality, integrity, and availability.

CVSS 4.0 · 8.5 High EPSS 2.3% KEV · Not listed
Vendors
Tp-link
Products
Archer Be3600 V1
CVE-2026-17250

Authenticated Remote Code Execution via Stack-Based Buffer Overflow in Firmware Update Handling

A stack-based buffer overflow vulnerability exists in the firmware update functionality of TL-MR6400 v7 due to unsafe processing of attacker-controlled metadata within a firmware image. Successful exploitation may allow an authenticated attacker to trigger memory corruption and execute arbitrary code on the affected device.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tl-mr6400 V7
CVE-2026-17251

Unauthenticated Denial of Service via Null Pointer Dereference in HTTP Request Parsing

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of  TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause the HTTP service process to crash, resulting in a denial-of-service condition and temporary loss of management or CGI functionality until service recovery.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tl-mr6400 V7
CVE-2026-17252

Unauthenticated Denial of Service via Composed HTTP Parsing and Stack-Based Out-of-Bounds Write Vulnerability in TL-MR6400 Web Management Interface

A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request. Successful exploitation may cause the web service process to crash, resulting in a denial-of-service condition and temporary loss of access to the router's web management interface.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tl-mr6400 V7
CVE-2025-14300

Unauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C425

The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5  exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in loss of connectivity and denial-of-service (DoS).

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo Tapo C200 Tapo C200 Firmware and 1 more
CVE-2025-30240

Arbitrary File Read via Improper Symlink Handling in USB HTTPS Access Path in multiple TP-Link Aginet Devices

The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to sensitive files within the device filesystem.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Eb810v(eu1) V1.0 Ex220(br) V1.0/1.20/1.28/1.29/1.8 Ex220(br) V2.0 and 30 more
CVE-2025-30241

OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices

Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions.  An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges. Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Eb210 Pro(eu1) 1.0 Eb210 Pro(us1) 1.0 Eb810v(eu1) V1.0 and 28 more
CVE-2026-12001

Hardcoded Credential Vulnerability in Multiple TP-Link Router Models

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR200 v5).  Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis. Successful exploitation could result in unauthorized access to privileged functions on affected devices.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Archer C20 V6 Archer Mr200 V5 Tl-wr845n V4 and 1 more
CVE-2025-30239

Sensitive Data Exposure due to Hardcoded Cryptographic Keys in Multiple TP-Link Aginet Devices

In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted sensitive configuration data, including credentials and service-related information.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Eb210 Pro(eu1) 1.0 Eb210 Pro(us1) 1.0 Eb810v(eu1) V1.0 and 62 more
CVE-2025-30237

Authentication Bypass via Broken Access Control in Web Server in Multiple TP-Link Aginet Devices

The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations. Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Aginet Ex141(br) V1.0/1.9 Ex141(eu1) V1.0 and 54 more
CVE-2025-30238

Privilege Escalation via Improper Authorization in User Management in multiple TP-Link Aginet Devices

In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Eb210 Pro(eu1) 1.0 Eb210 Pro(us1) 1.0 Eb810v(eu1) V1.0 and 56 more
CVE-2026-9030

Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6

A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safely manage concurrent systool operations.  By sending crafted systool instructions through the asynchronous request path, successful exploitation may cause the httpd process or device management service to crash and may result in temporary loss of access to the web management interface or device reboot.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Archer A6 V4
CVE-2026-9031

Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6

An input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation of user-supplied data before it is processed by internal flash-write handling logic. Successful exploitation may cause httpd process or device to crash, resulting in loss of access to the web interface and a denial-of-service condition.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Archer A6 V4
CVE-2025-9291

Improper Certificate Validation in TP-Link Omada Cloud Communications

A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validation protections to be bypassed under specific conditions. Successful exploitation may allow interception or modification of communication between affected devices and cloud controllers.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Access Point Omada Ds1008x Omada Ds1008x Firmware and 218 more
CVE-2025-15544

Weak Credential Protection During TP-Link Omada Device Adoption

A cryptographic weakness exists in the Omada device adoption process.  During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related authentication traffic may be able to recover valid credentials and gain unauthorized access to managed devices or controller-managed environments.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link Tp Link
Products
Omada Omada App Omada Controller and 228 more
CVE-2025-15627

Hardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol Authentication

A cryptographic weakness exists in the Omada adoption protocol.  The protocol relies on hard-coded cryptographic keys to establish trust and protect authentication exchanges between controllers and managed devices during device adoption. An attacker may be able to impersonate trusted controllers or managed devices and gain access to sensitive adoption-related communications.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link Tp Link
Products
Omada Controller Omada Ds1008x Omada Ds1008x Firmware and 225 more