CVE-2025-7850

HIGH

TP-Link Omada Gateways - Authenticated OS Command Injection

Title source: llm

A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.

Core 5

Core References

Vendor Advisory vendor-advisory

Product product

Product product

Product product

Various Sources

CVSS v3 7.2

EPSS 0.0090

EPSS Percentile 75.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

CWE

CWE-78

Status published

Products (26)

tp-link/er605_firmware 2.3.1

tp-link/er605_firmware < 2.3.1

tp-link/er706w-4g_firmware 1.2.1

tp-link/er706w-4g_firmware < 1.2.1

tp-link/er706w_firmware 1.2.1

tp-link/er706w_firmware < 1.2.1

tp-link/er707-m2_firmware 1.3.1

tp-link/er707-m2_firmware < 1.3.1

tp-link/er7206_firmware 2.2.2

tp-link/er7206_firmware < 2.2.2

... and 16 more

Published Oct 21, 2025

Tracked Since Feb 18, 2026