Tp-Link
230 CVEs across 1122 Tp-Link products. Browse Tp-Link vulnerabilities, severities, and proof-of-concept exploits.
Tp-Link products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15314 | High | 7.5 | 2026-08-04 | Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient i… |
CVE-2025-15631 | Medium | 5.9 | 2026-08-03 | A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficien… |
CVE-2025-15630 | Medium | 5.9 | 2026-08-03 | A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimat… |
CVE-2025-15629 | High | 7.5 | 2026-08-03 | A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed dev… |
CVE-2025-15628 | High | 7.5 | 2026-08-03 | Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices. An… |
CVE-2025-15627 | High | 7.5 | 2026-08-03 | A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-coded cryptographic keys to establish trust and protect authentica… |
CVE-2025-15544 | Medium | 5.9 | 2026-08-03 | A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmit… |
CVE-2025-9291 | Medium | 6.5 | 2026-08-03 | A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not ad… |
CVE-2026-9044 | High | 8.0 | 2026-07-31 | An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to ex… |
CVE-2026-9770 | Medium | 5.3 | 2026-07-15 | Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices. An attacker with… |
CVE-2026-13230 | Medium | 6.5 | 2026-07-15 | An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocatio… |
CVE-2026-5040 | Medium | 6.7 | 2026-07-14 | TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or pr… |
CVE-2026-15429 | High | 8.8 | 2026-07-14 | A privilege escalation vulnerability exists in the HTTP authentication component in Archer VX1800v v1. Improper handling of user-controlled input may allow new… |
CVE-2026-15428 | High | 8.8 | 2026-07-14 | An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who… |
CVE-2026-15427 | High | 8.1 | 2026-07-14 | An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitizati… |
CVE-2026-9105 | Medium | 6.5 | 2026-06-29 | An authenticated stack-based buffer overflow vulnerability exists in the web management interface of TP-Link TL-WR841N v14. A remote authenticated attacker ca… |
CVE-2026-12760 | Medium | 6.5 | 2026-06-24 | A denial-of-service (DoS) vulnerability has been identified in Tapo C200 v3 in the network packet handling logic due to improper handling of IPv4 fragmented pa… |
CVE-2026-11410 | High | 7.2 | 2026-06-17 | An authenticated OS command injection vulnerability exists in the BigPond Cable (BPA) WAN configuration module in TL-WR940N v6 due to improper sanitization of… |
CVE-2026-11409 | High | 7.2 | 2026-06-17 | An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due to improper sanitization of user input… |
CVE-2026-6250 | High | 8.1 | 2026-06-11 | An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to improper handling of user-controlled input. Externally control… |
CVE-2026-8714 | Medium | 6.5 | 2026-06-05 | A denial-of-service vulnerability exists in the RTSP server component of TP-Link Tapo C520WS v2 due to improper handling of syntactically invalid input. Craft… |
CVE-2026-1871 | Medium | 6.5 | 2026-06-02 | TP-Link Tapo C200 v5 contains a stack-based buffer overflow flaw in RTSP authentication handling due to improper validation of Authorization header field lengt… |
CVE-2026-34127 | Medium | 4.8 | 2026-05-29 | A stored cross-site scripting (XSS) vulnerability has been identified in the web management interface of TP-Link's TL-SG108PE v5 switch due to improper sanitat… |
CVE-2026-34126 | High | 7.5 | 2026-05-28 | TP-Link has identified a vulnerability in Tapo L535E v1.0 and v3.0, Tapo P300 v1.0, and Tapo D100C v1.0, where Bluetooth communication during the initial setup… |
CVE-2026-8697 | High | 8.8 | 2026-05-28 | Due to improper enforcement of authentication rate-limiting on a debug SSH service in Archer C64 v1, the SSH service allows unlimited authentication attempts a… |
CVE-2026-5509 | High | 7.2 | 2026-05-27 | An authenticated command injection vulnerability exists in the Archer BE450 v1 and BE7200 v1 router that allows an administrator to execute arbitrary system co… |
CVE-2026-3294 | High | 8.8 | 2026-05-22 | An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login param… |
CVE-2026-5511 | Low | 2.7 | 2026-05-19 | In the web management interface of Archer AX72 (SG) v1, the network diagnostic feature improperly handles invalid user input, resulting in limited exposure of… |
CVE-2018-25321 | Medium | 4.3 | 2026-05-17 | TP-Link TL-WR720N wireless router contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by c… |
CVE-2026-5039 | High | 8.8 | 2026-04-23 | TP-Link TL-WR841N v13 uses DES-CBC encryption in the TDDPv2 debug protocol with a cryptographic key derived from default web management credentials, making the… |
CVE-2026-5363 | High | 8.8 | 2026-04-16 | Inadequate Encryption Strength vulnerability in TP-Link Archer C7 v5 and v5.8 (uhttpd modules) allows Password Recovery Exploitation. The web interface encrypt… |
CVE-2026-30818 | High | 8.0 | 2026-04-08 | An OS command injection vulnerability in the dnsmasq module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute arbitrary code whe… |
CVE-2026-30817 | Medium | 5.7 | 2026-04-08 | An external configuration control vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary files wh… |
CVE-2026-30816 | Medium | 5.7 | 2026-04-08 | An external control of configuration vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary file… |
CVE-2026-30815 | High | 8.0 | 2026-04-08 | An OS command injection vulnerability in the OpenVPN module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute system commands wh… |
CVE-2026-30814 | High | 8.0 | 2026-04-08 | A stack-based buffer overflow in the tmpServer module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to trigger a segmentation fault and… |
CVE-2026-34124 | Medium | 6.5 | 2026-04-02 | A denial-of-service vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP request path parsing logic. The implementation enforces length res… |
CVE-2026-34122 | Medium | 6.5 | 2026-04-02 | A stack-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within a configuration handling component due to insufficient input vali… |
CVE-2026-34121 | High | 8.8 | 2026-04-02 | An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 was identified, due to inconsistent… |
CVE-2026-34120 | Medium | 6.5 | 2026-04-02 | A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the asynchronous parsing of local video stream content due to insu… |
CVE-2026-34119 | Medium | 6.5 | 2026-04-02 | A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing loop when appending segmented request bodies with… |
CVE-2026-34118 | Medium | 6.5 | 2026-04-02 | A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 in the HTTP POST body parsing logic due to missing validation of remainin… |
CVE-2026-4346 | Medium | 6.8 | 2026-03-26 | The vulnerability affecting TL-WR850N v3 allows cleartext storage of administrative and Wi-Fi credentials in a region of the device’s flash memory while the se… |
CVE-2026-3622 | High | 7.5 | 2026-03-26 | The vulnerability exists in the UPnP component of TL-WR841N v14, where improper input validation leads to an out-of-bounds read, potentially causing a crash of… |
CVE-2025-15606 | High | 7.5 | 2026-03-23 | A Denial-of-Service (DoS) vulnerability in the httpd component of TP-Link's TD-W8961N v4.0 due to improper input sanitization, allows crafted requests to trigg… |
CVE-2025-15605 | High | 7.3 | 2026-03-23 | A hardcoded cryptographic key within the configuration mechanism on TP-Link Archer NX200, NX210, NX500 and NX600 enables decryption and re-encryption of device… |
CVE-2025-15519 | High | 7.2 | 2026-03-23 | Improper input handling in a modem-management administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as… |
CVE-2025-15518 | High | 7.2 | 2026-03-23 | Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as… |
CVE-2025-15517 | High | 8.1 | 2026-03-23 | A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intend… |
CVE-2025-15608 | Critical | 9.8 | 2026-03-20 | This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results from insufficient input sanitization in the device’s probe handling logic, where unvalidated param… |
CVE-2025-15607 | Critical | 9.8 | 2026-03-20 | A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling, allowing log redirection to arbitrary files… |
CVE-2026-3227 | Medium | 6.8 | 2026-03-16 | A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements us… |
CVE-2026-1668 | Critical | 9.8 | 2026-03-13 | The web interface on multiple Omada switches does not adequately validate certain external inputs, which may lead to out-of-bound memory access when processing… |
CVE-2026-3841 | High | 8.8 | 2026-03-12 | A command injection vulnerability has been identified in the Telnet command-line interface (CLI) of TP-Link TL-MR6400 v5.3. This issue is caused by insufficie… |
CVE-2025-15568 | High | 8.0 | 2026-03-09 | A command injection vulnerability was identified in the web module of Archer AXE75 v1.6/v1.0 router. An authenticated attacker with adjacent-network access ma… |
CVE-2025-7375 | Medium | 6.5 | 2026-03-05 | A denial-of-service (DoS) vulnerability was identified in Omada EAP610 v3. An attacker with adjacent network access can send crafted requests to cause the dev… |
CVE-2026-0655 | High | 8.0 | 2026-03-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TP-Link Deco BE25 v1.0 (web modules) allows authenticated adjac… |
CVE-2026-0654 | High | 8.0 | 2026-03-02 | Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authent… |
CVE-2025-9293 | High | 8.1 | 2026-02-13 | A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communicati… |
CVE-2025-9292 | High | 7.5 | 2026-02-13 | A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitat… |
CVE-2026-1571 | Medium | 6.1 | 2026-02-11 | User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted… |
CVE-2026-0653 | Medium | 6.5 | 2026-02-10 | On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization… |
CVE-2026-0652 | High | 8.8 | 2026-02-10 | On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. A… |
CVE-2026-0651 | High | 7.8 | 2026-02-10 | A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The ser… |
CVE-2025-15557 | High | 8.8 | 2026-02-05 | An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept a… |
CVE-2025-15551 | Medium | 5.6 | 2026-02-05 | The response coming from TP-Link Archer MR200 v5.2, C20 v5 and v6, TL-WR850N v3, and TL-WR845N v4 for any request is getting executed by the JavaScript functio… |
CVE-2025-62673 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tdpserver modules) allows adjacent attackers to cause a segmentation fault or potentially… |
CVE-2025-62501 | High | 8.1 | 2026-02-03 | SSH Hostkey misconfiguration vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows attackers to obtain device credentials through a specially cr… |
CVE-2025-62405 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-62404 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-61983 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-61944 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-59487 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-59482 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-58455 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-58077 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2026-22228 | Medium | 4.9 | 2026-02-03 | An authenticated user with high privileges may trigger a denial‑of‑service condition in TP-Link Archer BE230 v1.2 by restoring a crafted configuration file con… |
CVE-2026-22220 | Medium | 4.5 | 2026-02-03 | A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web modules) may allow a crafted request to cause the device’s web… |
CVE-2026-22229 | High | 7.2 | 2026-02-02 | A command injection vulnerability may be exploited after the admin's authentication via the import of a crafted VPN client configuration file on the TP-Link Ar… |
CVE-2026-22227 | High | 7.2 | 2026-02-02 | A command injection vulnerability may be exploited after the admin's authentication via the configuration backup restoration function of the TP-Link Archer BE2… |
CVE-2026-22226 | High | 7.2 | 2026-02-02 | A command injection vulnerability may be exploited after the admin's authentication in the VPN server configuration module on TP-Link Archer BE230 v1.2 and Arc… |
CVE-2026-22225 | High | 7.2 | 2026-02-02 | A command injection vulnerability may be exploited after the admin's authentication in the VPN Connection Service on the Archer BE230 v1.2 and Archer AXE75 v1… |
CVE-2026-22224 | High | 7.2 | 2026-02-02 | A command injection vulnerability may be exploited after the admin's authentication in the cloud communication interface on the TP-Link Archer BE230 v1.2. Succ… |
CVE-2026-22223 | High | 8.0 | 2026-02-02 | An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) allows adjacent authenticated attacker execute arbitrary code. Successful… |
CVE-2026-22222 | High | 8.0 | 2026-02-02 | An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(web modules) allows adjacent authenticated attacker to execute arbitrary code. Successfu… |
CVE-2026-22221 | High | 8.0 | 2026-02-02 | An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) allows adjacent authenticated attacker execute arbitrary code. Successful… |
CVE-2026-0631 | High | 8.0 | 2026-02-02 | An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) and OpenVPN of AXE75 v1 allows an adjacent authenticated attacker to execut… |
CVE-2026-0630 | High | 8.0 | 2026-02-02 | An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(web modules) and Archer AXE75 v1.0 allows adjacent authenticated attacker to execute arb… |
CVE-2026-1457 | High | 8.8 | 2026-01-29 | An authenticated buffer handling flaw in TP-Link VIGI C385 V1 Web API lacking input sanitization, may allow memory corruption leading to remote code execution… |
CVE-2025-15548 | Medium | 6.5 | 2026-01-29 | Some VX800v v1.0 web interface endpoints transmit sensitive information over unencrypted HTTP due to missing application layer encryption, allowing a network a… |
CVE-2025-15543 | Medium | 4.6 | 2026-01-29 | Improper link resolution in USB HTTP access path in VX800v v1.0 allows a crafted USB device to expose root filesystem contents, giving an attacker with physica… |
CVE-2025-15542 | Medium | 5.3 | 2026-01-29 | Improper handling of exceptional conditions in VX800v v1.0 in SIP processing allows an attacker to flood the device with crafted INVITE messages, blocking all… |
CVE-2025-15541 | Medium | 6.3 | 2026-01-29 | Improper link resolution in the VX800v v1.0 SFTP service allows authenticated adjacent attackers to use crafted symbolic links to access system files, resultin… |
CVE-2025-13399 | High | 8.8 | 2026-01-29 | A weakness in the web interface’s application layer encryption in VX800v v1.0 allows an adjacent attacker to brute force the weak AES key and decrypt intercept… |
CVE-2025-15545 | Medium | 6.8 | 2026-01-29 | The backup restore function does not properly validate unexpected or unrecognized tags within the backup file. When such a crafted file is restored, the inject… |
CVE-2026-1315 | High | 7.5 | 2026-01-27 | By sending crafted files to the firmware update endpoint of Tapo C220 v1 and C520WS v2, the device terminates core system services before verifying authenticat… |
CVE-2026-0919 | High | 7.5 | 2026-01-27 | The HTTP parser of Tapo C210 v3, C220 v1 and C520WS v2 cameras improperly handles requests containing an excessively long URL path. An invalid‑URL error path c… |
CVE-2026-0918 | High | 7.5 | 2026-01-27 | The Tapo C100 v5, C220 v1 and C520WS v2 cameras’ HTTP service does not safely handle POST requests containing an excessively large Content-Length header. The r… |
CVE-2025-9522 | Medium | 5.3 | 2026-01-26 | Blind Server-Side Request Forgery (SSRF) in Omada Controllers through webhook functionality, enabling crafted requests to internal services, which may lead to… |
CVE-2025-9521 | Medium | 6.5 | 2026-01-26 | Password Confirmation Bypass vulnerability in Omada Controllers, allowing an attacker with a valid session token to bypass secondary verification, and change t… |