JVNVU#90150763
Multiple OS command injection vulnerabilities in TP-Link Omada gateways

Overview

Omada gateways provided by TP-Link Systems Inc. contain multiple OS command injection vulnerabilities.

Products Affected

• Omada gateway
  • ER8411 firmware versions prior to 1.3.3 Build 20251013 Rel.44647
  • ER7412-M2 firmware versions prior to 1.1.0 Build 20251015 Rel.63594
  • ER707-M2 firmware versions prior to 1.3.1 Build 20251009 Rel.67687
  • ER7206 firmware versions prior to 2.2.2 Build 20250724 Rel.11109
  • ER605 firmware versions prior to 2.3.1 Build 20251015 Rel.78291
  • ER706W firmware versions prior to 1.2.1 Build 20250821 Rel.80909
  • ER706W-4G firmware versions prior to 1.2.1 Build 20250821 Rel.82492
  • ER7212PC firmware versions prior to 2.1.3 Build 20251016 Rel.82571
  • G36 firmware versions prior to 1.1.4 Build 20251015 Rel.84206
  • G611 firmware versions prior to 1.2.2 Build 20251017 Rel.45512
  • FR365 firmware versions prior to 1.1.10 Build 20250626 Rel.81746
  • FR205 firmware versions prior to 1.0.3 Build 20251016 Rel.61376
  • FR307-M2 firmware versions prior to 1.2.5 Build 20251015 Rel.76743

Description

Omada gateways provided by TP-Link Systems Inc. Corporation Limited contain multiple vulnerabilities listed below.

• OS command injection using information obtained from the web management interface (CWE-78)
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.6
  • CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 7.2
  • CVE-2025-6541
• OS command injection in multiple parameters (CWE-78)
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 9.3
  • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 9.8
  • CVE-2025-6542

Impact

• An arbitrary OS command may be executed on the product by the attacker who can log in to the web management interface (CVE-2025-6541)
• An arbitrary OS command may be executed on the product by an attacker (CVE-2025-6542)

Solution

Update the Firmware
Update the firmware to the latest version according to the information provided by the developer.