A weakness in the web interface’s application layer encryption in VX800v v1.0 allows an adjacent attacker to brute force the weak AES key and decrypt intercepted traffic. Successful exploitation requires network proximity but no authentication, and may result in high impact to confidentiality, integrity, and availability of transmitted data.
The backup restore function does not properly validate unexpected or unrecognized tags within the backup file. When such a crafted file is restored, the injected tag is interpreted by a shell, allowing execution of arbitrary commands with root privileges. Successful exploitation allows the attacker to gain root-level command execution, compromising confidentiality, integrity and availability.
By sending crafted files to the firmware update endpoint of Tapo C220 v1 and C520WS v2, the device terminates core system services before verifying authentication or firmware integrity. An unauthenticated attacker can trigger a persistent denial of service, requiring a manual reboot or application initiated restart to restore normal device operation.
The HTTP parser of Tapo C210 v3, C220 v1 and C520WS v2 cameras improperly handles requests containing an excessively long URL path. An invalid‑URL error path continues into cleanup code that assumes allocated buffers exist, leading to a crash and service restart. An unauthenticated attacker can force repeated service crashes or device reboots, causing denial of service.
The Tapo C100 v5, C220 v1 and C520WS v2 cameras’ HTTP service does not safely handle POST requests containing an excessively large Content-Length header. The resulting failed memory allocation triggers a NULL pointer dereference, causing the main service process to crash. An unauthenticated attacker can repeatedly crash the service, causing temporary denial of service. The device restarts automatically, and repeated requests can keep it unavailable.
Blind Server-Side Request Forgery (SSRF) in Omada Controllers through webhook functionality, enabling crafted requests to internal services, which may lead to enumeration of information.
Password Confirmation Bypass vulnerability in Omada Controllers, allowing an attacker with a valid session token to bypass secondary verification, and change the user’s password without proper confirmation, leading to weakened account security.
An IDOR vulnerability exists in Omada Controllers that allows an attacker with Administrator permissions to manipulate requests and potentially hijack the Owner account.
Command injection vulnerability was found in the admin interface component of TP-Link Archer MR600 v5 firmware, allowing authenticated attackers to execute system commands with a limited character length via crafted input in the browser developer console, possibly leading to service disruption or full compromise.
An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.
CVE-2025-9289 is a medium-severity Cross-Site Scripting (XSS) vulnerability in TP-Link's Omada Software Controller. It arises from improper input sanitization of a parameter, allowing execution of arbitrary JavaScript in an authenticated administrator's browser. Exploitation requires network positioning or emulating a trusted entity, plus user interaction by a low-privileged authenticated admin. Successful attacks could expose sensitive information and compromise confidentiality. No known exploits are currently in the wild. The vulnerability has a CVSS 4.0 score of 5.7, reflecting moderate impact and complexity. European organizations using Omada Controllers should prioritize patching and restrict admin access. Countries with high TP-Link market penetration and critical infrastructure using Omada are most at risk.
Authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models allows an attacker on the LAN to reset the admin password without verification by manipulating client-side state. Attackers can gain full administrative access to the device, compromising configuration and network security.
A Null Pointer Dereference vulnerability exists in the referer header check of the web portal of TP-Link TL-WR841N v14, caused by improper input validation. A remote, unauthenticated attacker can exploit this flaw and cause Denial of Service on the web portal service.This issue affects TL-WR841N v14: before 250908.
Improper Input Validation vulnerability in TP-Link Archer AXE75 v1.6 (vpn modules) allows an authenticated adjacent attacker to delete arbitrary server file, leading to possible loss of critical system files and service interruption or degraded functionality.This issue affects Archer AXE75 v1.6: ≤ build 20250107.
CVE-2025-14631 is a high-severity NULL Pointer Dereference vulnerability in the TP-Link Archer BE400 Wi-Fi 6 USB adapter's 802.11 modules. An adjacent attacker can exploit this flaw to cause a denial-of-service (DoS) by triggering a device reboot without requiring authentication or user interaction. The vulnerability affects firmware version xi 1.1.0 Build 20250710 rel.14914. Although no known exploits are currently in the wild, the ease of exploitation and potential for service disruption make this a significant threat. European organizations relying on this device for network connectivity could face temporary loss of network access, impacting business operations. Mitigation requires close monitoring for vendor patches and implementing network segmentation to limit attacker proximity.
A vulnerability in the SSH server of TP-Link TL-WR820N v2.80 allows the use of a weak cryptographic algorithm, enabling an adjacent attacker to intercept and decrypt SSH traffic. Exploitation may expose sensitive information and compromise confidentiality.
The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in loss of connectivity and denial-of-service (DoS).
The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on the same local network segment can send crafted HTTPS requests to trigger excessive memory allocation, causing the device to crash and resulting in denial-of-service (DoS).
CVE-2025-8065 is a stack-based buffer overflow vulnerability in the ONVIF SOAP XML Parser of TP-Link Tapo C200 V3 and C520WS v2.6 devices. The flaw occurs when the parser processes XML tags with namespace prefixes without validating the prefix length before copying it to a fixed-size stack buffer. This allows an unauthenticated attacker on the same local network to send a crafted SOAP request with an oversized namespace prefix, causing memory corruption on the stack. Exploitation can lead to remote code execution with elevated privileges, resulting in full device compromise. The vulnerability has a high severity score of 8.7. No patch or official remediation information is currently provided by the vendor, and no known exploits are reported in the wild.
