CVE-2025-6542

CRITICAL

Product <Version - Command Injection

Title source: llm

An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.

Core 4

Core References

Vendor Advisory vendor-advisory

Product product

Product product

Product product

CVSS v3 9.8

EPSS 0.0015

EPSS Percentile 35.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

CWE

CWE-78

Status published

Products (26)

tp-link/er605_firmware 2.3.1

tp-link/er605_firmware < 2.3.1

tp-link/er706w-4g_firmware 1.2.1

tp-link/er706w-4g_firmware < 1.2.1

tp-link/er706w_firmware 1.2.1

tp-link/er706w_firmware < 1.2.1

tp-link/er707-m2_firmware 1.3.1

tp-link/er707-m2_firmware < 1.3.1

tp-link/er7206_firmware 2.2.2

tp-link/er7206_firmware < 2.2.2

... and 16 more

Published Oct 21, 2025

Tracked Since Feb 18, 2026