Tp Link
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Tp Link product.
RSS Feeds for Tp Link security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Tp Link products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Tp Link Sorted by Most Security Vulnerabilities since 2018
Known Exploited Tp Link Vulnerabilities
The following Tp Link vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability |
TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2023-50224 Exploit Probability: 17.5% |
September 3, 2025 |
| TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability |
TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2025-9377 Exploit Probability: 11.7% |
September 3, 2025 |
| TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability |
TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2020-24363 Exploit Probability: 20.7% |
September 2, 2025 |
| TP-Link Multiple Routers Command Injection Vulnerability |
TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2023-33538 Exploit Probability: 41.9% |
June 16, 2025 |
| TP-Link Archer AX-21 Command Injection Vulnerability |
TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution. CVE-2023-1389 Exploit Probability: 100.0% |
May 1, 2023 |
| TP-Link Multiple Archer Devices Directory Traversal Vulnerability |
Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/. CVE-2015-3035 Exploit Probability: 83.9% |
March 25, 2022 |
Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. 4 known exploited Tp Link vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.
By the Year
In 2026 there have been 152 vulnerabilities in Tp Link with an average score of 7.3 out of ten. Last year, in 2025 Tp Link had 32 security vulnerabilities published. That is, 120 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.15
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 152 | 7.30 |
| 2025 | 32 | 7.45 |
| 2024 | 59 | 7.50 |
| 2023 | 40 | 8.55 |
| 2022 | 11 | 7.00 |
| 2021 | 0 | 0.00 |
| 2020 | 12 | 0.00 |
| 2019 | 0 | 0.00 |
| 2018 | 7 | 9.80 |
It may take a day or so for new Tp Link vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Tp Link Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-84941 | Sep 10, 2026 |
TP-Link Omada Controller: Authenticated SAML Disclosure VulnerabilityAn information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information. |
Omada
|
| CVE-2026-17176 | Sep 10, 2026 |
TP-Link Deco BE11000 TDDP OS Command Injection via UDP (Root)An OS command injection vulnerability in the TDDP module of Deco BE11000 allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. Successful exploitation may lead to complete device compromise, including unauthorized command execution, modification of device settings, and loss of confidentiality, integrity, and availability |
|
| CVE-2026-76652 | Sep 10, 2026 |
Auth Dir Traversal in Archer MR600/TL-MR6400 UploadAn authenticated directory traversal vulnerability in file upload functionality has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8. Due to insufficient validation of user-supplied file information, an authenticated remote attacker with access to the affected upload functionality could upload a specially crafted file and cause it to be written outside the intended directory. Successful exploitation could allow an authenticated remote attacker to write files to unintended locations, potentially overwriting or modifying files accessible to the affected service; arbitrary code execution has not been demonstrated. |
|
| CVE-2026-76653 | Sep 10, 2026 |
Unauth Access in VPN Config for Archer MR600/TLMR6400A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials. Successful exploitation may allow a remote unauthenticated attacker to disclose and modify VPN configuration information. |
|
| CVE-2026-85384 | Sep 08, 2026 |
CVE-2026-85384 TP-Link RE210 AC750 httpd Stack Buffer Overflow (auth)A stack-based buffer overflow vulnerability exists in the httpd component of RE210 AC750 due to improper bounds checking in the splitString function when processing an uploaded configuration file. An authenticated attacker on the local network can upload a crafted configuration file to trigger the overflow, leading to remote code execution. Successful exploitation may allow unauthorized access to sensitive information, modification of device configuration and network behavior, or disruption of device availability. |
|
| CVE-2026-81531 | Sep 08, 2026 |
TP-Link Omada Controller Info Disclosure via Open API EndpointAn information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users. Successful exploitation may allow an attacker to remote query the affected endpoint that may facilitate user enumeration and subsequent attacks targeting administrative accounts. |
|
| CVE-2026-18167 | Sep 03, 2026 |
TP-Link Archer AX55 EasyMesh Buffer Overflow: RCE via Crafted InputA stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution on the device. Successful exploitation may cause the EasyMesh daemon to crash and may potentially allow remote code execution when Mesh mode is enabled. This may result in high impact to the confidentiality, integrity, and availability of the affected device. |
|
| CVE-2026-18330 | Sep 03, 2026 |
TP-Link Archer AX55 Hard-Coded RSA Key Disclosure (CVE-2026-18330)A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known shared RSA private key to decrypt the administrator password; the weakened AES session key further reduces the effort required to compromise session confidentiality. Successful exploitation may disclose the administrator password captured from an HTTP login session and compromise session confidentiality. |
|
| CVE-2026-75118 | Aug 28, 2026 |
TP-Link TL-MR100 V3.20 http_gdpr_decrypt buffer overflow before authA pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt function of TL-MR100 V3.20 due to insufficient bounds checking of encrypted requests to the /cgi/login endpoint. An adjacent unauthenticated attacker with access to the router's web management interface can trigger memory corruption and potentially achieve arbitrary code execution. Successful exploitation can overwrite saved control-flow data on the httpd process stack prior to authentication, resulting in a service crash or potential arbitrary code execution in the context of the affected process. |
|
| CVE-2026-76784 | Aug 26, 2026 |
TP-Link Kasa: App. Control Msg. Replay/Forge in Local Protocol (CVE-2026-76784)Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially resulting in unauthorized device control. Successful exploitation could allow an attacker to manipulate the operational state of an affected device, resulting in unauthorized state changes, disruption of normal device functionality or a denial-of-service condition. |
|
| CVE-2026-78541 | Aug 24, 2026 |
TP-Link Archer BE3600 V1 OS Command Injection via Parent-Control ProfileA stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report generation and may result in arbitrary command execution. Successful exploitation may allow command execution on the affected device with potential impact to device confidentiality, integrity, and availability. |
|
| CVE-2026-16348 | Aug 24, 2026 |
TP-Link Archer BE800 V1: Auth Cmd Injection via VPN (CVE-2026-16348)An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors, credential theft, LAN reconnaissance, and router-assisted attacks against connected devices. |
|
| CVE-2026-9254 | Aug 24, 2026 |
TP-Link Archer Routers OS Command Injection via Parental ControlAn unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inject arbitrary commands and execute them with root privileges. Successful exploitation may result in complete device compromise and impact the confidentiality, integrity, and availability of the affected device and network traffic. |
|
| CVE-2026-15469 | Aug 24, 2026 |
TP-Link Deco XE75 v3 RSA-512 Hard-Coded Key in MeshThe use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. A shared RSA-512 mesh group private key is present in the affected firmware and is used by the mesh protocol for node authentication. An attacker who obtains the firmware image and has local network access may be able to authenticate as a mesh node without possessing a device-specific credential. Successful exploitation may allow an unauthenticated adjacent attacker to impersonate a trusted mesh node and bypass mesh node authentication, which may permit unauthorized changes to device or mesh configuration, affecting confidentiality, integrity and availability. |
|
| CVE-2026-17252 | Aug 21, 2026 |
Stack-based OOB Write in TP-Link TL-MR6400 v7 Web Admin (CVE-2026-17252)A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request. Successful exploitation may cause the web service process to crash, resulting in a denial-of-service condition and temporary loss of access to the router's web management interface. |
|
| CVE-2026-17251 | Aug 21, 2026 |
TP-Link TL-MR6400 v7 Null Pointer in HTTP Request Parsing (DoS)A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause the HTTP service process to crash, resulting in a denial-of-service condition and temporary loss of management or CGI functionality until service recovery. |
|
| CVE-2026-17250 | Aug 21, 2026 |
TL-MR6400 v7 Firmware Buffer Overflow Enables RCEA stack-based buffer overflow vulnerability exists in the firmware update functionality of TL-MR6400 v7 due to unsafe processing of attacker-controlled metadata within a firmware image. Successful exploitation may allow an authenticated attacker to trigger memory corruption and execute arbitrary code on the affected device. |
|
| CVE-2026-19683 | Aug 20, 2026 |
Unencrypted DDNS Credential Transmission in TP-Link Omada GatewayA vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path. Successful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment. |
|
| CVE-2026-19586 | Aug 20, 2026 |
TP-Link Omada Gateway OpenVPN Server Command InjectionA pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt. Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device. |
|
| CVE-2026-9033 | Aug 20, 2026 |
TP-Link Captive Portal Session Termination (CVE-2026-9033)An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access. Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate. |
|
| CVE-2026-8619 | Aug 19, 2026 |
TP-Link TL-MR100 v3.2 HTTP DoS via NULL-pointerAn unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference. A remote attacker on an adjacent network can send a specially crated HTTP request to trigger a crash of the HTTP service process. Successful exploitation may cause the HTTP service to crash, making the web management interface and HTTP-dependent functionality temporarily unavailable. |
|
| CVE-2026-75616 | Aug 19, 2026 |
TP-Link Archer C20 v6 OS Command Injection via WAN ConfigAn OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting in full device compromise. Successful exploitation may allow arbitrary command execution with elevated privileges, compromising the confidentiality, integrity, and availability of the affected device and network traffic passing through it. |
|
| CVE-2026-75619 | Aug 19, 2026 |
TP-Link Tapo C100/C101 RTSP Heap Buffer Overflow DoSTapo C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, resulting in out-of-bounds heap writes. Successful exploitation can crash the RTSP service and trigger a device reboot, resulting in a temporary denial-of-service condition. |
Tapo
|
| CVE-2026-75618 | Aug 19, 2026 |
Tapo C100/C101 V5 RTSP Null Pointer DoSTapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and device reboot. Successful exploitation can disrupt live video streaming functionality and cause a temporary denial-of-service condition. |
Tapo
|
| CVE-2026-15316 | Aug 18, 2026 |
DoS via Oversized Ciphertext in Tapo C200 Config ServiceAn improper input validation vulnerability in the configuration service for processing encrypted credential data has been identified in Tapo C200 v5. An attacker can send oversized crypted ciphertext values that may trigger exception handling failures, due to insufficient validation, causing the affected device to crash or restart. Successful exploitation may temporarily disrupt HTTPS management and monitoring functionality, resulting in a denial-of-service (DoS) condition until the service recovers. |
Tapo
|
| CVE-2026-15315 | Aug 18, 2026 |
Tapo C200 v5 Improper Auth Allows Local Priv Escalation & DoSTapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification module. An attacker on the local network can exploit weaknesses in challenge parameter validation to bypass normal authentication controls and obtain administrative session tokens. Successful exploitation may allow an attacker to subsequently execute privileged management actions, enable unauthorized administrative access and temporary disruption of device services, resulting in a denial-of-service (DoS) condition. |
Tapo
|
| CVE-2026-15141 | Aug 12, 2026 |
TP-Link Router Referrer Header Bypass in Web UI Enables Config DisclosureThe web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficient validation logic. Successful exploitation may allow an adjacent attacker with access to the web management interface to obtain device configuration details and other sensitive information. |
|
| CVE-2025-30241 | Aug 10, 2026 |
Cmd. Injection in TP-Link Aginet Web UICertain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges. Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise. |
|
| CVE-2025-30240 | Aug 10, 2026 |
TP-Link AgNet Symbolic Link Validation Bypass via USB (File Read)The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to sensitive files within the device filesystem. |
|
| CVE-2025-30239 | Aug 10, 2026 |
TP-Link Aginet Hardcoded Crypto Key Exposure Enables Decryption of Config DataIn affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted sensitive configuration data, including credentials and service-related information. |
|
| CVE-2025-30238 | Aug 10, 2026 |
TP-Link Aginet Auth Bypass: Low-Priv Users Gain Admin RightsIn affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings. |
|
| CVE-2025-30237 | Aug 10, 2026 |
Unauth Access Bypass on TP-Link Aginet Web UIThe affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations. Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device. |
|
| CVE-2026-12339 | Aug 10, 2026 |
CVE-2026-12339: Zip Slip in TP-Link WebUI Upgrade Admin File OverwriteA Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability. |
|
| CVE-2026-9031 | Aug 07, 2026 |
TP-Link HTTP-WRITEOEM Flash Write DoS via Insufficient Input ValidationAn input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation of user-supplied data before it is processed by internal flash-write handling logic. Successful exploitation may cause httpd process or device to crash, resulting in loss of access to the web interface and a denial-of-service condition. |
|
| CVE-2026-9030 | Aug 07, 2026 |
TP-Link Archer A6 v4 HTTPD Async Systool DoS via Race ConditionA denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safely manage concurrent systool operations. By sending crafted systool instructions through the asynchronous request path, successful exploitation may cause the httpd process or device management service to crash and may result in temporary loss of access to the web management interface or device reboot. |
|
| CVE-2026-15314 | Aug 04, 2026 |
Buffer Overflow in Tapo P110 HTTP Body Handling Leads to DoSTapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient input validation before memory copy operations. This may lead to buffer overflow condition, causing the web service process to crash. Successful exploitation may cause the web service process to stop responding or restart, resulting in a denial-of-service condition. |
|
| CVE-2025-15631 | Aug 03, 2026 |
TP-Link Omada Cred Hash WeaknessA cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized access to affected devices or management environments. |
Omada
|
| CVE-2025-15630 | Aug 03, 2026 |
CVE-2025-15630: Race Condition in Omada AdoptionA race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker. Successful exploitation may allow disclosure of provisioning information intended for a legitimate device. |
Omada
|
| CVE-2025-9291 | Aug 03, 2026 |
TP-Link Omada Gateway Cert Validation Bypass (CVE-2025-9291)A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validation protections to be bypassed under specific conditions. Successful exploitation may allow interception or modification of communication between affected devices and cloud controllers. |
Omada
|
| CVE-2026-9044 | Jul 31, 2026 |
TP-Link AXE75 V1 OpenVPN Command Injection (pre-1.5.6 Build 20260623)An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper filtering of special characters. Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability. |
|
| CVE-2026-12935 | Jul 29, 2026 |
TL-WR940N RTSP Buffer Overflow Enables RCEThe TL-WR940N v6 router contains a vulnerability in its RTSP connection tracking module that can lead to a stack-based buffer overflow. The issue occurs when a LAN client initiates a connection to a malicious RTSP server controlled by an attacker. A specially crafted RTSP message may trigger improper memory handling within the kernel module Successful exploitation of this vulnerability may result in a denial-of-service (DoS) condition or allow remote code execution (RCE), potentially leading to full compromise of the device. This vulnerability can be exploited by an unauthenticated attacker under the device's default configuration. |
|
| CVE-2026-12001 | Jul 27, 2026 |
TP-Link Router Firmware Hardcoded Credential Exposure in FirmwareA hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR200 v5). Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis. Successful exploitation could result in unauthorized access to privileged functions on affected devices. |
|
| CVE-2026-13230 | Jul 15, 2026 |
TP-Link Kasa EC70/EC71 v4 Local Discovery Geo-Info DisclosureAn information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocation information without requiring authentication. This issue allows an attacker on the same local network to retrieve geolocation-related data through crafted responses. The vulnerability impacts confidentiality only, with no evidence of integrity of availability impact. |
|
| CVE-2026-9770 | Jul 15, 2026 |
TP-Link Kasa EC71/EC70 v4 Static Private Key Leak Enables MITMKasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices. An attacker with access to the firmware image can extract the embedded key. Successful exploitation may allow an unauthenticated attacker on the same network to use this key in the web management service, compromising the confidentiality of encrypted communications. This may enable passive decryption of traffic or active man-in-the-middle (MITM) attacks |
|
| CVE-2026-5040 | Jul 14, 2026 |
TP-Link Deco M5 Weak Password Hashing Enables Credentials DisclosureTP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force or dictionary attacks. Successful exploitation may result in disclosure of authentication credentials, enabling unauthorized access to device management functions, depending on the privileges associated with the recovered password. The primary security impact is loss of confidentiality. |
|
| CVE-2026-15429 | Jul 14, 2026 |
TP-Link Archer VX1800v: HTTP Auth Input Tainted Leads to Priv EscalationA privilege escalation vulnerability exists in the HTTP authentication component in Archer VX1800v v1. Improper handling of user-controlled input may allow newline characters to be injected into internally constructed configuration data. An authenticated user with sufficient privileges may be able to modify account settings and gain elevated administrative privileges. |
|
| CVE-2026-15428 | Jul 14, 2026 |
TP-Link Archer VX800v v1 Root RCE via OS Command InjectionAn OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who can access the relevant HTTP interface can modify the parameter to inject shell metacharacters, resulting in arbitrary code execution with root privileges. Successful exploitation may allow remote code execution and complete compromise of the device. |
|
| CVE-2026-15427 | Jul 14, 2026 |
CVE-2026-15427 TP-Link Archer VX1800v V1 OS Command Injection via TR-069/CWMPAn OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitization of parameters, allowing crafted input to be executed as system-level commands. Exploitation requires specific conditions such as TR-069 being enabled and ability to influence ACS-delivered commands, compromise or control an ACS server. Successful exploitation may allow arbitrary command execution with root privileges, resulting in complete compromise of the device. |
|
| CVE-2026-8699 | Jul 02, 2026 |
XSS in Archer C5 v6.8 Management Interface Enables JS ExecutionA stored Cross-Site Scripting (XSS) vulnerability has been identified in the web-based management interface of Archer C5 v6.8 routers, due to insufficient server-side validation and lack of proper output encoding of user-controlled input in a certain field. An attacker with administrative privileges can inject crafted HTML or JS payloads into the affected field. The payload is stored and later executed when the affected page is rendered in an administrator's browser.Successful exploitation allows execution of arbitrary JavaScript in an admin's browser, potentially leading to session hijacking and unauthorized access to router configuration, possibly resulting in exposure of sensitive data and modification of device settings. The vulnerability affects ISP-managed firmware variants of the product. Remediation is coordinated through service providers. |
|
| CVE-2026-10562 | Jun 30, 2026 |
Unauth URL Redirect in TP-Link Archer AX20 v2.1.9 Build 20230829An unauthenticated URL redirection vulnerability has been identified in Archer AX20 V2 due to improper validation of user-supplied URL input within the web interface. An unauthenticated attacker can craft URLs containing URL-encoded path traversal sequences. When processed by the embedded web server, these inputs may cause the device to respond with HTTP 3xx redirects to attacker-controlled external domains. This issue affects Archer AX20 V2.0: through 2.1.9 Build 20230829. |