Threat database

CVE-2026-8619 is a high-severity unauthenticated denial-of-service vulnerability affecting TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0, and Archer MR600 v2 devices. The issue arises from improper handling of exceptional HTTP request conditions leading to a NULL pointer dereference. A remote attacker on an adjacent network can send a crafted HTTP request to crash the HTTP service process, causing temporary unavailability of the web management interface and HTTP-dependent functions.

A heap-based buffer overflow vulnerability exists in the RTSP service of TP-Link Systems Inc. Tapo C100/C101 version 5 devices. An authenticated attacker on the local network can send specially crafted RTSP frames with oversized length values, causing out-of-bounds heap writes. Exploitation can crash the RTSP service and reboot the device, resulting in a temporary denial-of-service condition.

A null pointer dereference vulnerability exists in the RTSP service of TP-Link Tapo C100/C101 version 5 devices. An attacker on the local network can send crafted requests that cause the service to dereference an invalid pointer, leading to a service crash and device reboot. This results in disruption of live video streaming and a temporary denial-of-service condition.

CVE-2026-75616 is an OS command injection vulnerability in the web management interface of TP-Link Archer C20 v6 firmware. It affects certain WAN-related configuration operations and requires authenticated administrator access. Exploitation allows execution of arbitrary system commands with elevated privileges, potentially leading to full device compromise and impacting confidentiality, integrity, and availability of the device and network traffic.

CVE-2026-15316 is an improper input validation vulnerability in the configuration service of TP-Link Tapo C200 v5. It involves processing encrypted credential data where oversized ciphertext values can cause exception handling failures. Successful exploitation leads to device crashes or restarts, causing temporary denial-of-service (DoS) by disrupting HTTPS management and monitoring until recovery.

TP-Link Tapo C120 v1 and C200 v5 devices have an improper authentication vulnerability in their login authentication verification module. This flaw allows a local network attacker to bypass authentication by exploiting weaknesses in challenge parameter validation. Successful exploitation grants administrative session tokens, enabling privileged management actions and unauthorized administrative access. The vulnerability can also cause temporary disruption of device services, leading to denial-of-service conditions.

The web interface of the affected device relies on the HTTP referrer header as part of request validation.  Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficient validation logic. Successful exploitation may allow an adjacent attacker with access to the web management interface to obtain device configuration details and other sensitive information.

Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions.  An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges. Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise.

The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to sensitive files within the device filesystem.

In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted sensitive configuration data, including credentials and service-related information.

In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings.

The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations. Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device.

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.

An input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation of user-supplied data before it is processed by internal flash-write handling logic. Successful exploitation may cause httpd process or device to crash, resulting in loss of access to the web interface and a denial-of-service condition.

A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safely manage concurrent systool operations.  By sending crafted systool instructions through the asynchronous request path, successful exploitation may cause the httpd process or device management service to crash and may result in temporary loss of access to the web management interface or device reboot.

Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient input validation before memory copy operations. This may lead to buffer overflow condition, causing the web service process to crash. Successful exploitation may cause the web service process to stop responding or restart, resulting in a denial-of-service condition.

A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized access to affected devices or management environments.

A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker. Successful exploitation may allow disclosure of provisioning information intended for a legitimate device.

A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed devices may be predictable due to insufficient entropy in session key generation. An attacker who successfully intercepts adoption-related communications may be able to recover session encryption keys and decrypt affected communications.