TP-Link has released security updates to address four security flaws impacting Omada gateway devices, including two critical bugs that could result in arbitrary code execution.
The vulnerabilities in question are listed below –
- CVE-2025-6541 (CVSS score: 8.6) – An operating system command injection vulnerability that could be exploited by an attacker who can log in to the web management interface to run arbitrary commands
- CVE-2025-6542 (CVSS score: 9.3) – An operating system command injection vulnerability that could be exploited by a remote unauthenticated attacker to run arbitrary commands
- CVE-2025-7850 (CVSS score: 9.3) – An operating system command injection vulnerability that could be exploited by an attacker in possession of an administrator password of the web portal to run arbitrary commands
- CVE-2025-7851 (CVSS score: 8.7) – An improper privilege management vulnerability that could be exploited by an attacker to obtain the root shell on the underlying operating system under restricted conditions
“Attackers may execute arbitrary commands on the device’s underlying operating system,” TP-Link said in an advisory released Tuesday.
The issues impact the following product models and versions –
- ER8411 < 1.3.3 Build 20251013 Rel.44647
- ER7412-M2 < 1.1.0 Build 20251015 Rel.63594
- ER707-M2 < 1.3.1 Build 20251009 Rel.67687
- ER7206 < 2.2.2 Build 20250724 Rel.11109
- ER605 < 2.3.1 Build 20251015 Rel.78291
- ER706W < 1.2.1 Build 20250821 Rel.80909
- ER706W-4G < 1.2.1 Build 20250821 Rel.82492
- ER7212PC < 2.1.3 Build 20251016 Rel.82571
- G36 < 1.1.4 Build 20251015 Rel.84206
- G611 < 1.2.2 Build 20251017 Rel.45512
- FR365 < 1.1.10 Build 20250626 Rel.81746
- FR205 < 1.0.3 Build 20251016 Rel.61376
- FR307-M2 < 1.2.5 Build 20251015 Rel.76743
While TP-Link makes no mention of the flaws being exploited in the wild, it’s advised that users move quickly to download and update to the latest firmware to fix the vulnerabilities.
“Check the configurations of the device after the firmware upgrade to ensure that all settings remain accurate, secure, and aligned with their intended preferences,” it added.
It also noted in a disclaimer that it cannot bear any responsibility for any consequences that may arise if the aforementioned recommended actions are not adhered to.
More Details About CVE-2025-7850 and CVE-2025-7851 Emerge
Forescout Research Vedere Labs, in a report shared with The Hacker News, said CVE-2025-7850 allows operating system command injection via WireGuard VPN settings and CVE-2025-7851 enables unauthorized root access through residual debug code, characterizing the bugs as arising as a result of a partial fix for CVE-2024-21827 that created alternate attack paths.
- CVE-2025-7850 – Improper sanitization of the WireGuard VPN private key in the Web UI enables authenticated attackers to execute arbitrary operating system commands as root
- CVE-2025-7851 – The cli_server binary exposes hidden functionality that permits root SSH logins
“CVE-2025-7850 can be exploited without valid credentials — allowing remote command execution in some deployments,” security researchers Stanislav Dashevskyi and Francesco La Spina said. “Protocol analysis revealed scenarios beyond initial local exploitation.”
The operational technology security company said it discovered additional vulnerabilities, most of which are critical and remotely exploitable. They are expected to be patched by Q1 2026.
“Vendors typically patch the reported issues, but they do not always perform root-cause remediation across the codebase,” the company pointed out. “Unfortunately, systemic faults that caused the original bugs may remain. The combination of recurring code-patterns plus partial fixes creates fertile ground for variant hunting.”
(The story was updated after publication on October 23, 2025, with additional details related to CVE-2025-7850 and CVE-2025-7851 from Forescout.)
