CveMateVulnerability intelligence

TP Link Systems Inc. vulnerabilities, page 2

201 vulnerabilities

Known vulnerabilities in TP Link Systems Inc. products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 430 products.

CVE-2025-9522tp-link systems inc.omada controller+18mo ago26-01-2026 19:35

Blind Server-Side Request Forgery (SSRF) in Omada Controllers through webhook functionality, enabling crafted requests to internal services, which may lead to enumeration of information.CVE-2025-9961tp-link systems inc.ax10 v1/v1.2/v2/v2.6/v3/v3.6+11y ago06-09-2025 06:50

An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500. The exploit can only be conducted via a Man-In-The-Middle (MITM) attack. This issue affects AX10 V1/V1.2/V2/V2.6/V3/V3.6: before 1.2.1; AX1500 V1/V1.20/V1.26/V1.60/V1.80/V2.60/V3.6: before 1.3.11.CVE-2025-9377tp-link systems inc.archer c7(eu) v2+4KEV1y ago29-08-2025 17:30

The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9. This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108. Both products have reached the status of EOL (end-of-life). It's recommending to purchase the new product to ensure better performance and security. If replacement is not an option in the short term, please use the second reference link to download and install the patch(es).CVE-2025-9292tp-link systems inc.omada cloud controller+148mo ago13-02-2026 00:21

A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could allow unauthorized disclosure of sensitive information. Fixed in updated Omada Cloud Controller service versions deployed automatically by TP‑Link. No user action is required.CVE-2025-9521tp-link systems inc.omada controller+18mo ago26-01-2026 19:35

Password Confirmation Bypass vulnerability in Omada Controllers, allowing an attacker with a valid session token to bypass secondary verification, and change the user’s password without proper confirmation, leading to weakened account security.CVE-2025-9291tp-link systems inc.omada access points+1112mo ago03-08-2026 17:48

A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validation protections to be bypassed under specific conditions. Successful exploitation may allow interception or modification of communication between affected devices and cloud controllers.CVE-2025-9290tp-link systems inc.omada access point (eap215 bridge kit 3.0, eap211 bridge kit 3.0)+859mo ago22-01-2026 23:14

An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.CVE-2025-9293tp link systems inc.omada app+278mo ago13-02-2026 00:22

A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication. An attacker in a privileged network position may be able to intercept or modify traffic if they can position themselves within the communication channel. Successful exploitation may compromise confidentiality, integrity, and availability of application data.CVE-2025-14737tp-link systems inc.wa850re+110mo ago18-12-2025 18:00

Command Injection vulnerability in TP-Link WA850RE (httpd modules) allows authenticated adjacent attacker to inject arbitrary commands.This issue affects: ≤ WA850RE V2_160527, ≤ WA850RE V3_160922.CVE-2025-14738tp-link systems inc.wa850re+110mo ago18-12-2025 18:01

Improper authentication vulnerability in TP-Link WA850RE (httpd modules) allows unauthenticated attackers to download the configuration file.This issue affects: ≤ WA850RE V2_160527, ≤ WA850RE V3_160922.CVE-2025-14553tp-link systems inc.tp-link tapo app10mo ago16-12-2025 18:38

Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo cameras, allowing attackers to brute force the password in the local network. Issue can be mitigated through mobile application updates. Device firmware remains unchanged.CVE-2025-14175tp-link systems inc.tl-wr820n v2.8+19mo ago29-12-2025 19:31

A vulnerability in the SSH server of TP-Link TL-WR820N v2.80 allows the use of a weak cryptographic algorithm, enabling an adjacent attacker to intercept and decrypt SSH traffic. Exploitation may expose sensitive information and compromise confidentiality.CVE-2025-14299tp-link systems inc.tapo c200 v3+110mo ago20-12-2025 00:42

The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on the same local network segment can send crafted HTTPS requests to trigger excessive memory allocation, causing the device to crash and resulting in denial-of-service (DoS).CVE-2025-14300tp link systems inc.tapo c100 v5+310mo ago20-12-2025 00:43

The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in loss of connectivity and denial-of-service (DoS).CVE-2025-14756tp-link systems inc.archer mr600 v5.0+18mo ago26-01-2026 18:17

Command injection vulnerability was found in the admin interface component of TP-Link Archer MR600 v5 firmware, allowing authenticated attackers to execute system commands with a limited character length via crafted input in the browser developer console, possibly leading to service disruption or full compromise.CVE-2025-14739tp-link systems inc.wr940n and wr941nd10mo ago18-12-2025 18:02

Access of Uninitialized Pointer vulnerability in TP-Link WR940N and WR941ND allows local unauthenticated attackers the ability to execute DoS attack and potentially arbitrary code execution under the context of the ‘root’ user.This issue affects WR940N and WR941ND: ≤ WR940N v5 3.20.1 Build 200316, ≤ WR941ND v6 3.16.9 Build 151203.CVE-2025-14631tp-link systems inc.archer be400+19mo ago07-01-2026 01:04

A NULL Pointer Dereference vulnerability in TP-Link Archer BE400 V1(802.11 modules) allows an adjacent attacker to cause a denial-of-service (DoS) by triggering a device reboot. This issue affects Archer BE400: xi 1.1.0 Build 20250710 rel.14914.CVE-2025-4975tp-link systems inc.tp-link tapo app1y ago22-05-2025 21:17

When a notification relating to low battery appears for a user with whom the device has been shared, tapping the notification grants full access to the power settings of that device.CVE-2025-25427tp-link systems inc.tl-wr841n v14/v14.6/v14.8+11y ago18-04-2025 00:03

A stored cross-site scripting (XSS) vulnerability in the upnp.htm page of the web Interface in TP-Link WR841N v14/v14.6/v14.8 <= Build 241230 Rel. 50788n allows remote attackers to inject arbitrary JavaScript code via the port mapping description. This leads to an execution of the JavaScript payload when the upnp page is loaded.CVE-2025-7375tp-link systems inc.eap610 v3+17mo ago05-03-2026 17:47

A denial-of-service (DoS) vulnerability was identified in Omada EAP610 v3. An attacker with adjacent network access can send crafted requests to cause the device’s HTTP service to crash. This results in temporary service unavailability until the device is rebooted. This issue affects Omada EAP610 firmware versions prior to 1.6.0.