Threat database

CVE-2026-102298 is a high-severity authorization bypass vulnerability in TP-Link Omada Software Controller (Windows) versions prior to 6.3.0.45. In MSP mode, the user-confirmation endpoint does not properly enforce permission checks, allowing authenticated users to supply a manipulated identifier parameter. This flaw enables user enumeration, credential verification, and unauthorized access to MSP resources or targeted accounts.

The TP-Link Tapo S505 device firmware version 1.6 stores device-specific cryptographic material in plaintext within nonvolatile storage. This cleartext storage allows an attacker with physical access to the device to extract sensitive cryptographic information. Exploitation could lead to disclosure of this material and potentially increase the risk of unauthorized access to protected information or communications related to the device.

TP-Link TL-WR841N version 14 contains an authenticated OS command injection vulnerability in its IPv6 WAN configuration. An authenticated administrator can exploit this flaw by providing a crafted IPv6 Gateway value that is improperly handled in a system command. This may lead to arbitrary command execution on the device, potentially allowing unauthorized access to sensitive information, modification of device settings, or disruption of device operation.

An information disclosure vulnerability has been identified in Omada Controller.  An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users.  Successful exploitation may allow an attacker to remote query the affected endpoint that may facilitate user enumeration and subsequent attacks targeting administrative accounts.

CVE-2026-76651 is a buffer overflow vulnerability in the embedded HTTP service of TP-Link TL-WR841N v14. It occurs when processing multipart/form-data requests due to insufficient validation of an attacker-controlled boundary parameter. This can lead to memory corruption by overwriting data beyond an internal buffer. While arbitrary code execution, information disclosure, and denial-of-service have not been demonstrated, the vulnerability may cause undefined application behavior.

CVE-2026-76650 is a NULL pointer dereference vulnerability in the UPnP service of TP-Link TL-WR841N v14. It occurs when processing SOAP state variable query requests, potentially causing the UPnP service process to terminate unexpectedly or become unstable. Exploitation results in a denial-of-service condition affecting UPnP discovery and management functions until the process is restarted or the device rebooted. The vulnerability has a medium severity rating with a CVSS score of 5.3. No patch or official remediation guidance is currently available.

CVE-2026-76649 is a NULL pointer dereference vulnerability in the UPnP service of TP-Link System Inc.'s TL-WR841N v14 router. It occurs when processing specially crafted SOAP action requests containing unexpected XML content, causing the UPnP daemon to terminate unexpectedly. Successful exploitation results in a denial-of-service condition affecting UPnP functionality until the service is restarted or the device is rebooted. The vulnerability has a medium severity with a CVSS score of 5.3. No patch or official remediation information is currently available.

An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and BE3600 v1 (vpn modules) allows adjacent authenticated attacker execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.

EPSS 1.4%VulnerabilityTP-Link System Inc.#cwe-78United States+9

Improper input validation vulnerability in TP-Link System Inc. TL-WR940N V6 (UPnP modules), which allows unauthenticated adjacent attackers to perform DoS attack. This issue affects TL-WR940N V6 <= Build 220801.

EPSS 0.2%VulnerabilityTP-Link System Inc.#cwe-20Germany+6

A Clickjacking vulnerability in TP-Link Archer C1200 web management page allows an attacker to trick users into performing unintended actions via rendered UI layers or frames.This issue affects Archer C1200 <= 1.1.5.

EPSS 0.5%VulnerabilityTP-Link System Inc.#cwe-1021Germany+9