An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.
CVE-2025-9289 is a medium-severity Cross-Site Scripting (XSS) vulnerability in TP-Link's Omada Software Controller. It arises from improper input sanitization of a parameter, allowing execution of arbitrary JavaScript in an authenticated administrator's browser. Exploitation requires network positioning or emulating a trusted entity, plus user interaction by a low-privileged authenticated admin. Successful attacks could expose sensitive information and compromise confidentiality. No known exploits are currently in the wild. The vulnerability has a CVSS 4.0 score of 5.7, reflecting moderate impact and complexity. European organizations using Omada Controllers should prioritize patching and restrict admin access. Countries with high TP-Link market penetration and critical infrastructure using Omada are most at risk.
Authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models allows an attacker on the LAN to reset the admin password without verification by manipulating client-side state. Attackers can gain full administrative access to the device, compromising configuration and network security.
A Null Pointer Dereference vulnerability exists in the referer header check of the web portal of TP-Link TL-WR841N v14, caused by improper input validation. A remote, unauthenticated attacker can exploit this flaw and cause Denial of Service on the web portal service.This issue affects TL-WR841N v14: before 250908.
Improper Input Validation vulnerability in TP-Link Archer AXE75 v1.6 (vpn modules) allows an authenticated adjacent attacker to delete arbitrary server file, leading to possible loss of critical system files and service interruption or degraded functionality.This issue affects Archer AXE75 v1.6: ≤ build 20250107.
CVE-2025-14631 is a high-severity NULL Pointer Dereference vulnerability in the TP-Link Archer BE400 Wi-Fi 6 USB adapter's 802.11 modules. An adjacent attacker can exploit this flaw to cause a denial-of-service (DoS) by triggering a device reboot without requiring authentication or user interaction. The vulnerability affects firmware version xi 1.1.0 Build 20250710 rel.14914. Although no known exploits are currently in the wild, the ease of exploitation and potential for service disruption make this a significant threat. European organizations relying on this device for network connectivity could face temporary loss of network access, impacting business operations. Mitigation requires close monitoring for vendor patches and implementing network segmentation to limit attacker proximity.
A vulnerability in the SSH server of TP-Link TL-WR820N v2.80 allows the use of a weak cryptographic algorithm, enabling an adjacent attacker to intercept and decrypt SSH traffic. Exploitation may expose sensitive information and compromise confidentiality.
The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in loss of connectivity and denial-of-service (DoS).
The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on the same local network segment can send crafted HTTPS requests to trigger excessive memory allocation, causing the device to crash and resulting in denial-of-service (DoS).
CVE-2025-8065 is a stack-based buffer overflow vulnerability in the ONVIF SOAP XML Parser of TP-Link Tapo C200 V3 and C520WS v2.6 devices. The flaw occurs when the parser processes XML tags with namespace prefixes without validating the prefix length before copying it to a fixed-size stack buffer. This allows an unauthenticated attacker on the same local network to send a crafted SOAP request with an oversized namespace prefix, causing memory corruption on the stack. Exploitation can lead to remote code execution with elevated privileges, resulting in full device compromise. The vulnerability has a high severity score of 8.7. No patch or official remediation information is currently provided by the vendor, and no known exploits are reported in the wild.
Access of Uninitialized Pointer vulnerability in TP-Link WR940N and WR941ND allows local unauthenticated attackers the ability to execute DoS attack
and potentially arbitrary code execution
under the context of the ‘root’ user.This issue affects WR940N and WR941ND: ≤ WR940N v5 3.20.1 Build 200316,
≤
WR941ND v6 3.16.9 Build 151203.
Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo cameras, allowing attackers to brute force the password in the local network. Issue can be mitigated through mobile application updates. Device firmware remains unchanged.
Improper input validation vulnerability in TP-Link System Inc. TL-WR940N V6 (UPnP modules), which allows unauthenticated adjacent attackers to perform DoS attack. This issue affects TL-WR940N V6 <= Build 220801.
