Threat database

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report generation and may result in arbitrary command execution. Successful exploitation may allow command execution on the affected device with potential impact to device confidentiality, integrity, and availability.

An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection.  Successful exploitation may enable persistent backdoors, credential theft, LAN reconnaissance, and router-assisted attacks against connected devices.

An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inject arbitrary commands and execute them with root privileges. Successful exploitation may result in complete device compromise and impact the confidentiality, integrity, and availability of the affected device and network traffic.

The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6.  A shared RSA-512 mesh group private key is present in the affected firmware and is used by the mesh protocol for node authentication.  An attacker who obtains the firmware image and has local network access may be able to authenticate as a mesh node without possessing a device-specific credential. Successful exploitation may allow an unauthenticated adjacent attacker to impersonate a trusted mesh node and bypass mesh node authentication, which may permit unauthorized changes to device or mesh configuration, affecting confidentiality, integrity and availability.

A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request. Successful exploitation may cause the web service process to crash, resulting in a denial-of-service condition and temporary loss of access to the router's web management interface.

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of  TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause the HTTP service process to crash, resulting in a denial-of-service condition and temporary loss of management or CGI functionality until service recovery.

CVE-2026-17250 is a stack-based buffer overflow vulnerability in the firmware update functionality of TP-Link TL-MR6400 version 7.0. It arises from unsafe handling of attacker-controlled metadata within a firmware image. Exploitation requires authentication and can lead to memory corruption and arbitrary code execution on the device. The vulnerability has a high severity score of 8.5. No patch or official fix information is currently provided.

A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path.  Successful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment.

CVE-2026-19586 is a critical OS command injection vulnerability in TP-Link ER7212PC v2 devices configured as OpenVPN servers. It allows unauthenticated remote attackers to execute arbitrary commands by sending crafted input during OpenVPN connection establishment before authentication. Exploitation requires the OpenVPN Server feature to be enabled and reachable by the attacker. Successful exploitation could lead to full device compromise.

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.  Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.

CVE-2026-8619 is a high-severity unauthenticated denial-of-service vulnerability affecting TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0, and Archer MR600 v2 devices. The issue arises from improper handling of exceptional HTTP request conditions leading to a NULL pointer dereference. A remote attacker on an adjacent network can send a crafted HTTP request to crash the HTTP service process, causing temporary unavailability of the web management interface and HTTP-dependent functions.

A heap-based buffer overflow vulnerability exists in the RTSP service of TP-Link Systems Inc. Tapo C100/C101 version 5 devices. An authenticated attacker on the local network can send specially crafted RTSP frames with oversized length values, causing out-of-bounds heap writes. Exploitation can crash the RTSP service and reboot the device, resulting in a temporary denial-of-service condition.

A null pointer dereference vulnerability exists in the RTSP service of TP-Link Tapo C100/C101 version 5 devices. An attacker on the local network can send crafted requests that cause the service to dereference an invalid pointer, leading to a service crash and device reboot. This results in disruption of live video streaming and a temporary denial-of-service condition.

CVE-2026-75616 is an OS command injection vulnerability in the web management interface of TP-Link Archer C20 v6 firmware. It affects certain WAN-related configuration operations and requires authenticated administrator access. Exploitation allows execution of arbitrary system commands with elevated privileges, potentially leading to full device compromise and impacting confidentiality, integrity, and availability of the device and network traffic.

CVE-2026-15316 is an improper input validation vulnerability in the configuration service of TP-Link Tapo C200 v5. It involves processing encrypted credential data where oversized ciphertext values can cause exception handling failures. Successful exploitation leads to device crashes or restarts, causing temporary denial-of-service (DoS) by disrupting HTTPS management and monitoring until recovery.

TP-Link Tapo C120 v1 and C200 v5 devices have an improper authentication vulnerability in their login authentication verification module. This flaw allows a local network attacker to bypass authentication by exploiting weaknesses in challenge parameter validation. Successful exploitation grants administrative session tokens, enabling privileged management actions and unauthorized administrative access. The vulnerability can also cause temporary disruption of device services, leading to denial-of-service conditions.

The web interface of the affected device relies on the HTTP referrer header as part of request validation.  Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficient validation logic. Successful exploitation may allow an adjacent attacker with access to the web management interface to obtain device configuration details and other sensitive information.

Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions.  An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges. Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise.

The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to sensitive files within the device filesystem.