CVE Feed

    Dashboard / CVE / CVE-2024-21827

    CVE-2024-21827

    A leftover debug code vulnerability exists in the cli_server debug functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.4.1 Build 20240117 Rel.57421. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.

    Published:Jun 25, 2024
    Last Modified:Nov 4, 2025
    EPS:Jun 25, 2024
    EPSS Score:0.00115
    CVSS Score:7.2

    Affected Products

    Vendor
    Tp-link
    Product
    Er7206
    Vendor
    Tp-link
    Product
    Er7206 Firmware

    Exploits

    https://talosintelligence.com/vulnerability_reports/TALOS-2024-1947https://talosintelligence.com/vulnerability_reports/TALOS-2024-1947

    Common Weakness Enumeration

    CWE-489 Active Debug Code

    Related CVEs

    CVE-2026-19683 (CVSS 6.3) — A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication…
    CVE-2026-19586 (CVSS 9.3) — A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to op…
    CVE-2026-9033 (CVSS 6) — An unauthenticated attacker with network access to the captive portal service of an affected device can termin…
    CVE-2025-9290 (CVSS 6) — An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device …
    CVE-2025-7851 (CVSS 8.7) — An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gate…
    CVE-2025-7850 (CVSS 9.3) — A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada…
    CVE-2025-6542 (CVSS 9.3) — An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.…
    CVE-2025-6541 (CVSS 8.6) — An arbitrary OS command may be executed on the product by the user who can log in to the web management interf…
    CVE-2023-43482 (CVSS 7.2) — A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit V…
    CVE-2023-36498 (CVSS 7.2) — A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER720…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High