CVE-2025-6541

HIGH

Product <Version> - Command Injection

Title source: llm

An arbitrary OS command may be executed on the product by the user who can log in to the web management interface.

Core 4

Core References

Vendor Advisory vendor-advisory

Product product

Product product

Product product

CVSS v3 8.8

EPSS 0.0009

EPSS Percentile 26.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

CWE

CWE-78

Status published

Products (26)

tp-link/er605_firmware 2.3.1

tp-link/er605_firmware < 2.3.1

tp-link/er706w-4g_firmware 1.2.1

tp-link/er706w-4g_firmware < 1.2.1

tp-link/er706w_firmware 1.2.1

tp-link/er706w_firmware < 1.2.1

tp-link/er707-m2_firmware 1.3.1

tp-link/er707-m2_firmware < 1.3.1

tp-link/er7206_firmware 2.2.2

tp-link/er7206_firmware < 2.2.2

... and 16 more

Published Oct 21, 2025

Tracked Since Feb 18, 2026