TP-Link has released security updates to address four security flaws impacting Omada gateway devices, including two critical bugs that could result in arbitrary code execution.
The vulnerabilities in question are listed below –
- CVE-2025-6541 (CVSS score: 8.6) – An operating system command injection vulnerability that could be exploited by an attacker who can log in to the web management interface to run arbitrary commands
- CVE-2025-6542 (CVSS score: 9.3) – An operating system command injection vulnerability that could be exploited by a remote unauthenticated attacker to run arbitrary commands
- CVE-2025-7850 (CVSS score: 9.3) – An operating system command injection vulnerability that could be exploited by an attacker in possession of an administrator password of the web portal to run arbitrary commands
- CVE-2025-7851 (CVSS score: 8.7) – An improper privilege management vulnerability that could be exploited by an attacker to obtain the root shell on the underlying operating system under restricted conditions
“Attackers may execute arbitrary commands on the device’s underlying operating system,” TP-Link said in an advisory released Tuesday.
The issues impact the following product models and versions –
- ER8411 < 1.3.3 Build 20251013 Rel.44647
- ER7412-M2 < 1.1.0 Build 20251015 Rel.63594
- ER707-M2 < 1.3.1 Build 20251009 Rel.67687
- ER7206 < 2.2.2 Build 20250724 Rel.11109
- ER605 < 2.3.1 Build 20251015 Rel.78291
- ER706W < 1.2.1 Build 20250821 Rel.80909
- ER706W-4G < 1.2.1 Build 20250821 Rel.82492
- ER7212PC < 2.1.3 Build 20251016 Rel.82571
- G36 < 1.1.4 Build 20251015 Rel.84206
- G611 < 1.2.2 Build 20251017 Rel.45512
- FR365 < 1.1.10 Build 20250626 Rel.81746
- FR205 < 1.0.3 Build 20251016 Rel.61376
- FR307-M2 < 1.2.5 Build 20251015 Rel.76743
While TP-Link makes no mention of the flaws being exploited in the wild, it’s advised that users move quickly to download and update to the latest firmware to fix the vulnerabilities.
“Check the configurations of the device after the firmware upgrade to ensure that all settings remain accurate, secure, and aligned with their intended preferences,” it added.
It also noted in a disclaimer that it cannot bear any responsibility for any consequences that may arise if the aforementioned recommended actions are not adhered to.
