CVEvulnerability

CVE-2025-7850

9.3 CRITICAL Published 2025-10-21 Modified 2026-10-18 Official page ↗
Status
Modified
Published
2025-10-21
Last modified
2026-10-18
Assigner
f23511db-6c3e-4e32-a477-6aa17d310630
CVSS 4.0 (f23511db-6c3e-4e32-a477-6aa17d310630)
9.3 CRITICAL — CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78

Description

A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.

Affected configurations

• tp-link er8411 firmware (< 1.3.3) • tp-link er8411 firmware 1.3.3 • tp-link er7412-m2 firmware (< 1.1.0) • tp-link er7412-m2 firmware 1.1.0 • tp-link er707-m2 firmware (< 1.3.1) • tp-link er707-m2 firmware 1.3.1 • tp-link er7206 firmware (< 2.2.2) • tp-link er7206 firmware 2.2.2 • tp-link er605 firmware (< 2.3.1) • tp-link er605 firmware 2.3.1 • tp-link er706w firmware (< 1.2.1) • tp-link er706w firmware 1.2.1 • tp-link er706w-4g firmware (< 1.2.1) • tp-link er706w-4g firmware 1.2.1 • tp-link er7212pc firmware (< 2.1.3) • tp-link er7212pc firmware 2.1.3 • tp-link g36 firmware (< 1.1.4) • tp-link g36 firmware 1.1.4 • tp-link g611 firmware (< 1.2.2) • tp-link g611 firmware 1.2.2 • tp-link fr365 firmware (< 1.1.10) • tp-link fr365 firmware 1.1.10 • tp-link fr205 firmware (< 1.0.3) • tp-link fr205 firmware 1.0.3 • tp-link fr307-m2 firmware (< 1.2.5) • tp-link fr307-m2 firmware 1.2.5

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References