CVE-2025-14737
HIGHTP-Link TL-WA850RE Firmware < 160527 - Authenticated OS Command Injection
Title source: llmDescription
Command Injection vulnerability in TP-Link WA850RE (httpd modules) allows authenticated adjacent attacker to inject arbitrary commands.This issue affects: ≤ WA850RE V2_160527, ≤ WA850RE V3_160922.
References (4)
Core 4
Core References
Third Party Advisory
https://blog.exodusintel.com/2022/06/23/tp-link-wa850re-remote-command-injection-vulnerability/
Product, Release Notes
https://www.tp-link.com/us/support/download/tl-wa850re/v2/#Firmware
Product, Release Notes
https://www.tp-link.com/us/support/download/tl-wa850re/v3/#Firmware
Vendor Advisory
https://www.tp-link.com/us/support/faq/4848/
Scores
CVSS v3
8.0
EPSS
0.0020
EPSS Percentile
41.8%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-78
Status
published
Products (1)
tp-link/tl-wa850re_firmware
< 160527
Published
Dec 18, 2025
Tracked Since
Feb 18, 2026