Filtered by vendor Tp-link
Subscribe
Total
548 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-15141 | 1 Tp-link | 2 Tl-wr820n, Tl-wr820n Firmware | 2026-09-09 | N/A | 5.7 MEDIUM |
| The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficient validation logic. Successful exploitation may allow an adjacent attacker with access to the web management interface to obtain device configuration details and other sensitive information. | |||||
| CVE-2026-75616 | 1 Tp-link | 2 Archer C20, Archer C20 Firmware | 2026-09-08 | N/A | 6.8 MEDIUM |
| An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting in full device compromise. Successful exploitation may allow arbitrary command execution with elevated privileges, compromising the confidentiality, integrity, and availability of the affected device and network traffic passing through it. | |||||
| CVE-2026-19683 | 1 Tp-link | 36 Dr3150, Dr3150 Firmware, Dr3220v-4g and 33 more | 2026-09-08 | N/A | 7.4 HIGH |
| A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path. Successful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment. | |||||
| CVE-2026-9033 | 1 Tp-link | 36 Dr3150, Dr3150 Firmware, Dr3220v-4g and 33 more | 2026-09-08 | N/A | 4.3 MEDIUM |
| An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access. Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate. | |||||
| CVE-2026-15315 | 1 Tp-link | 4 Tapo C120, Tapo C120 Firmware, Tapo C200 and 1 more | 2026-09-04 | N/A | 8.8 HIGH |
| Tapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification module. An attacker on the local network can exploit weaknesses in challenge parameter validation to bypass normal authentication controls and obtain administrative session tokens. Successful exploitation may allow an attacker to subsequently execute privileged management actions, enable unauthorized administrative access and temporary disruption of device services, resulting in a denial-of-service (DoS) condition. | |||||
| CVE-2026-15316 | 1 Tp-link | 2 Tapo C200, Tapo C200 Firmware | 2026-09-04 | N/A | 6.5 MEDIUM |
| An improper input validation vulnerability in the configuration service for processing encrypted credential data has been identified in Tapo C200 v5. An attacker can send oversized crypted ciphertext values that may trigger exception handling failures, due to insufficient validation, causing the affected device to crash or restart. Successful exploitation may temporarily disrupt HTTPS management and monitoring functionality, resulting in a denial-of-service (DoS) condition until the service recovers. | |||||
| CVE-2026-75618 | 1 Tp-link | 4 Tapo C100, Tapo C100 Firmware, Tapo C101 and 1 more | 2026-09-04 | N/A | 6.5 MEDIUM |
| Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and device reboot. Successful exploitation can disrupt live video streaming functionality and cause a temporary denial-of-service condition. | |||||
| CVE-2026-75619 | 1 Tp-link | 4 Tapo C100, Tapo C100 Firmware, Tapo C101 and 1 more | 2026-09-04 | N/A | 5.7 MEDIUM |
| Tapo C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, resulting in out-of-bounds heap writes. Successful exploitation can crash the RTSP service and trigger a device reboot, resulting in a temporary denial-of-service condition. | |||||
| CVE-2023-50224 | 1 Tp-link | 72 Archer C1900, Archer C1900 Firmware, Archer C5 and 69 more | 2026-09-03 | N/A | 6.5 MEDIUM |
| TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899. | |||||
| CVE-2026-19586 | 1 Tp-link | 36 Dr3150, Dr3150 Firmware, Dr3220v-4g and 33 more | 2026-09-03 | N/A | 9.8 CRITICAL |
| A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt. Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device. | |||||
| CVE-2026-8619 | 1 Tp-link | 8 Archer Mr600, Archer Mr600 Firmware, Tl-mr100 and 5 more | 2026-09-03 | N/A | 7.5 HIGH |
| An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference. A remote attacker on an adjacent network can send a specially crated HTTP request to trigger a crash of the HTTP service process. Successful exploitation may cause the HTTP service to crash, making the web management interface and HTTP-dependent functionality temporarily unavailable. | |||||
| CVE-2026-34118 | 1 Tp-link | 2 Tapo C520ws, Tapo C520ws Firmware | 2026-08-19 | N/A | 6.5 MEDIUM |
| A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C100/C101 v5, C520WS v2.6 in the HTTP POST body parsing logic due to missing validation of remaining buffer capacity after dynamic allocation, due to insufficient boundary validation when handling externally supplied HTTP input. An attacker on the same network segment could trigger heap memory corruption conditions by sending crafted payloads that cause write operations beyond allocated buffer boundaries. Successful exploitation causes a Denial-of-Service (DoS) condition, causing the device’s process to crash or become unresponsive. | |||||
| CVE-2025-14300 | 1 Tp-link | 2 Tapo C200, Tapo C200 Firmware | 2026-08-14 | N/A | 8.1 HIGH |
| The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in loss of connectivity and denial-of-service (DoS). | |||||
| CVE-2025-15608 | 1 Tp-link | 2 Archer Ax53, Archer Ax53 Firmware | 2026-08-12 | N/A | 9.8 CRITICAL |
| This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results from insufficient input sanitization in the device’s probe handling logic, where unvalidated parameters can trigger a stack-based buffer overflow that causes the affected service to crash and, under specific conditions, may enable remote code execution through complex heap-spray techniques. Successful exploitation may result in repeated service unavailability and, in certain scenarios, allow an attacker to gain control of the device. | |||||
| CVE-2026-15314 | 1 Tp-link | 2 Tapo P110, Tapo P110 Firmware | 2026-08-07 | N/A | 7.5 HIGH |
| Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient input validation before memory copy operations. This may lead to buffer overflow condition, causing the web service process to crash. Successful exploitation may cause the web service process to stop responding or restart, resulting in a denial-of-service condition. | |||||
| CVE-2026-9044 | 1 Tp-link | 2 Archer Axe75, Archer Axe75 Firmware | 2026-08-07 | N/A | 8.0 HIGH |
| An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper filtering of special characters. Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability. | |||||
| CVE-2025-9291 | 1 Tp-link | 218 Omada Ds1008x, Omada Ds1008x Firmware, Omada Ds1016g and 215 more | 2026-08-07 | N/A | 6.5 MEDIUM |
| A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validation protections to be bypassed under specific conditions. Successful exploitation may allow interception or modification of communication between affected devices and cloud controllers. | |||||
| CVE-2025-15544 | 1 Tp-link | 225 Omada, Omada Ds1008x, Omada Ds1008x Firmware and 222 more | 2026-08-07 | N/A | 5.9 MEDIUM |
| A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related authentication traffic may be able to recover valid credentials and gain unauthorized access to managed devices or controller-managed environments. | |||||
| CVE-2025-15627 | 1 Tp-link | 224 Omada Ds1008x, Omada Ds1008x Firmware, Omada Ds1016g and 221 more | 2026-08-07 | N/A | 7.5 HIGH |
| A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-coded cryptographic keys to establish trust and protect authentication exchanges between controllers and managed devices during device adoption. An attacker may be able to impersonate trusted controllers or managed devices and gain access to sensitive adoption-related communications. | |||||
| CVE-2025-15628 | 1 Tp-link | 224 Omada Ds1008x, Omada Ds1008x Firmware, Omada Ds1016g and 221 more | 2026-08-07 | N/A | 7.5 HIGH |
| Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices. An attacker who obtains the embedded certificates may be able to impersonate trusted controllers or devices and intercept affected communications. | |||||