Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 632

Export CSV
CVE-2025-15628

Hardcoded Certificates in TP-Link Omada Device Communications

Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices. An attacker who obtains the embedded certificates may be able to impersonate trusted controllers or devices and intercept affected communications.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Access Points Omada Controller Omada Ds1008x and 226 more
CVE-2025-15629

Weak Session Key Generation in TP-Link Omada Adoption Protocol

A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed devices may be predictable due to insufficient entropy in session key generation. An attacker who successfully intercepts adoption-related communications may be able to recover session encryption keys and decrypt affected communications.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Access Point Omada Controller Omada Ds1008x and 225 more
CVE-2025-15630

Device Provisioning Race Condition in TP-Link Omada Adoption Workflow

A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker. Successful exploitation may allow disclosure of provisioning information intended for a legitimate device.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Access Point Omada Controller Omada Ds1008x and 225 more
CVE-2025-15631

Weak Credential Storage in TP-Link Omada Devices

A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized access to affected devices or management environments.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Omada Access Point Omada Ds1008x Omada Ds1008x Firmware and 219 more
CVE-2026-15314

Authenticated Denial-of-Service Vulnerability in TP-Link Tapo P110

Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient input validation before memory copy operations. This may lead to buffer overflow condition, causing the web service process to crash. Successful exploitation may cause the web service process to stop responding or restart, resulting in a denial-of-service condition.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
P110 V1 Tapo P110 Tapo P110 Firmware
CVE-2026-0651

Path Traversal on TP-Link Tapo D235, C211, C520WS and C260 via Local https

A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to using the raw path when normalization fails. An attacker can exploit this logic flaw by supplying crafted, URL encoded traversal sequences that bypass directory restrictions and allow access to files outside the intended web root. Successful exploitation may allow authenticated attackers to get disclosure of sensitive system files and credentials, while unauthenticated attackers may gain access to non-sensitive static assets.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo C260 Tapo C260 Firmware Tapo C260 V1
CVE-2026-9044

Command Injection Vulnerability in OpenVPN of TP-Link Archer AXE75

An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper filtering of special characters.  Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability.

CVSS 4.0 · 8.5 High EPSS 2.5% KEV · Not listed
Vendors
Tp-link
Products
Archer Axe75 Archer Axe75 Firmware Axe75 V1
CVE-2026-12935

Unauthenticated Remote Code Execution in TP-Link TL-WR940N RTSP Conntrack Feature

The TL-WR940N v6 router contains a vulnerability in its RTSP connection tracking module that can lead to a stack-based buffer overflow. The issue occurs when a LAN client initiates a connection to a malicious RTSP server controlled by an attacker. A specially crafted RTSP message may trigger improper memory handling within the kernel module Successful exploitation of this vulnerability may result in a denial-of-service (DoS) condition or allow remote code execution (RCE), potentially leading to full compromise of the device. This vulnerability can be exploited by an unauthenticated attacker under the device's default configuration.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tl-wr940n V6
CVE-2026-15427

OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v

An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitization of parameters, allowing crafted input to be executed as system-level commands. Exploitation requires specific conditions such as TR-069 being enabled and ability to influence ACS-delivered commands, compromise or control an ACS server. Successful exploitation may allow arbitrary command execution with root privileges, resulting in complete compromise of the device.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Archer Vx1800v Archer Vx1800v Firmware Archer Vx1800v V1
CVE-2026-15428

OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v

An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who can access the relevant HTTP interface can modify the parameter to inject shell metacharacters, resulting in arbitrary code execution with root privileges. Successful exploitation may allow remote code execution and complete compromise of the device.

CVSS 4.0 · 8.5 High EPSS 2.1% KEV · Not listed
Vendors
Tp-link
Products
Archer Vx1800v Archer Vx1800v Firmware Archer Vx1800v V1
CVE-2026-15429

Privilege Escalation via Improper Input Sanitization in TP-Link Archer VX1800v

A privilege escalation vulnerability exists in the HTTP authentication component in Archer VX1800v v1. Improper handling of user-controlled input may allow newline characters to be injected into internally constructed configuration data.  An authenticated user with sufficient privileges may be able to modify account settings and gain elevated administrative privileges.

CVSS 4.0 · 5.1 Medium EPSS 1.4% KEV · Not listed
Vendors
Tp-link
Products
Archer Vx1800v Archer Vx1800v Firmware Archer Vx1800v V1
CVE-2026-5040

Weak Password Hashing Mechanism in TP-Link Deco M5

TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force or dictionary attacks. Successful exploitation may result in disclosure of authentication credentials, enabling unauthorized access to device management functions, depending on the privileges associated with the recovered password. The primary security impact is loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Deco M5 Deco M5 Deco M5 V1 Deco M5 Firmware
CVE-2026-9770

Hardcoded Cryptographic Key Information Disclosure Vulnerability on TP-Link Kasa EC70 and EC71

Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices.  An attacker with access to the firmware image can extract the embedded key.  Successful exploitation may allow an unauthenticated attacker on the same network to use this key in the web management service, compromising the confidentiality of encrypted communications. This may enable passive decryption of traffic or active man-in-the-middle (MITM) attacks

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Kasa Ec70 Kasa Ec70 Firmware Kasa Ec70 V4 and 3 more
CVE-2026-13230

Information Disclosure Vulnerability in Local Discovery Response in TP-Link Kasa EC70 and EC71

An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocation information without requiring authentication. This issue allows an attacker on the same local network to retrieve geolocation-related data through crafted responses. The vulnerability impacts confidentiality only, with no evidence of integrity of availability impact.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Kasa Ec70 Kasa Ec70 Firmware Kasa Ec70 V4 and 3 more
CVE-2025-15608

Buffer Overflow in Network Probe Handling Function of TP-Link Archer AX53 + Archer AX55

This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results from insufficient input sanitization in the device’s probe handling logic, where unvalidated parameters can trigger a stack-based buffer overflow that causes the affected service to crash and, under specific conditions, may enable remote code execution through complex heap-spray techniques. Successful exploitation may result in repeated service unavailability and, in certain scenarios, allow an attacker to gain control of the device.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Archer Ax53 Archer Ax53 Firmware Ax53 V1
CVE-2026-8699

Stored Cross-Site Scripting (XSS) in TP-Link Archer C5 Web Management Interface

A stored Cross-Site Scripting (XSS) vulnerability has been identified in the web-based management interface of Archer C5 v6.8 routers, due to insufficient server-side validation and lack of proper output encoding of user-controlled input in a certain field.  An attacker with administrative privileges can inject crafted HTML or JS payloads into the affected field. The payload is stored and later executed when the affected page is rendered in an administrator's browser.Successful exploitation allows execution of arbitrary JavaScript in an admin's browser, potentially leading to session hijacking and unauthorized access to router configuration, possibly resulting in exposure of sensitive data and modification of device settings. The vulnerability affects ISP-managed firmware variants of the product. Remediation is coordinated through service providers.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Archer C5
CVE-2026-3227

Authenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840N

A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an authenticated attacker to upload a crafted configuration file that results in execution of OS commands with root privileges during port-trigger processing. Successful exploitation allows an authenticated attacker to execute system commands with root privileges, leading to full device compromise.

CVSS 4.0 · 8.5 High EPSS 3.0% KEV · Not listed
Vendors
Tp-link Tp Link
Products
Tl-wr802n Tl-wr802n Firmware Tl-wr840n and 4 more
CVE-2026-10562

Unauthenticated Open Redirect Vulnerability on TP-Link Archer AX20 Web Interface

An unauthenticated URL redirection vulnerability has been identified in Archer AX20 V2 due to improper validation of user-supplied URL input within the web interface.  An unauthenticated attacker can craft URLs containing URL-encoded path traversal sequences. When processed by the embedded web server, these inputs may cause the device to respond with HTTP 3xx redirects to attacker-controlled external domains. This issue affects Archer AX20 V2.0: through 2.1.9 Build 20230829.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Archer Ax20
CVE-2026-9105

Authenticated Stack-Based Buffer Overflow in TP-Link TL-WR841N Web Interface

An authenticated stack-based buffer overflow vulnerability exists in the web management interface of TP-Link TL-WR841N v14. A remote authenticated attacker can send crafted HTTP requests to cause the embedded web server to overflow a stack buffer, resulting in a crash of the affected process. Successful exploitation results in a denial-of-service condition, causing the device to crash and automatically reboot.

CVSS 4.0 · 6.8 Medium EPSS 1.1% KEV · Not listed
Vendors
Tp-link
Products
Tl-wr841n Tl-wr841n Firmware Tl-wr841n V14
CVE-2026-11834

Unauthenticated Command Injection via DHCP Option Handling in Multiple TP-Link Routers

A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router models, due to insufficient validation of externally supplied DHCP option data. An adjacent attacker may exploit this vulnerability by supplying crafted DHCP responses, potentially resulting in unauthorized command execution during device initialization or provisioning workflows. This typically occurs when the device is in a factory-default or unconfigured state. Successful exploitation may allow an adjacent, unauthenticated attacker to execute arbitrary commands with elevated privileges, potentially leading to full compromise of the affected device and unauthorized administrative control.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tp-link Tp Link
Products
Archer C20 V5 Archer C20 V6 Archer Mr200 V07 and 4 more