CVE Feed

    Dashboard / CVE / CVE-2025-7850

    CVE-2025-7850

    A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.

    Published:Oct 21, 2025
    Last Modified:Oct 24, 2025
    EPS:Oct 21, 2025
    EPSS Score:0.01135
    CVSS Score:7.2

    Affected Products

    Vendor
    Tp-link
    Product
    Er605
    Vendor
    Tp-link
    Product
    Er605 Firmware
    Vendor
    Tp-link
    Product
    Er706w
    Vendor
    Tp-link
    Product
    Er706w-4g
    Vendor
    Tp-link
    Product
    Er706w-4g Firmware
    Vendor
    Tp-link
    Product
    Er706w Firmware
    Vendor
    Tp-link
    Product
    Er707-m2
    Vendor
    Tp-link
    Product
    Er707-m2 Firmware
    Vendor
    Tp-link
    Product
    Er7206
    Vendor
    Tp-link
    Product
    Er7206 Firmware
    Vendor
    Tp-link
    Product
    Er7212pc
    Vendor
    Tp-link
    Product
    Er7212pc Firmware
    Vendor
    Tp-link
    Product
    Er7412-m2
    Vendor
    Tp-link
    Product
    Er7412-m2 Firmware
    Vendor
    Tp-link
    Product
    Er8411
    Vendor
    Tp-link
    Product
    Er8411 Firmware
    Vendor
    Tp-link
    Product
    Fr205
    Vendor
    Tp-link
    Product
    Fr205 Firmware
    Vendor
    Tp-link
    Product
    Fr307-m2
    Vendor
    Tp-link
    Product
    Fr307-m2 Firmware
    Vendor
    Tp-link
    Product
    Fr365
    Vendor
    Tp-link
    Product
    Fr365 Firmware
    Vendor
    Tp-link
    Product
    G36
    Vendor
    Tp-link
    Product
    G36 Firmware
    Vendor
    Tp-link
    Product
    G611
    Vendor
    Tp-link
    Product
    G611 Firmware
    Vendor
    Tp-link
    Product
    Omada Gateways

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-19683 (CVSS 6.3) — A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication…
    CVE-2026-19586 (CVSS 9.3) — A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to op…
    CVE-2026-9033 (CVSS 6) — An unauthenticated attacker with network access to the captive portal service of an affected device can termin…
    CVE-2025-9290 (CVSS 6) — An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device …
    CVE-2025-7851 (CVSS 8.7) — An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gate…
    CVE-2025-6542 (CVSS 9.3) — An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.…
    CVE-2025-6541 (CVSS 8.6) — An arbitrary OS command may be executed on the product by the user who can log in to the web management interf…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High