TP-Link Systems Inc.
158 CVEs across 338 TP-Link Systems Inc. products. Browse TP-Link Systems Inc. vulnerabilities, severities, and proof-of-concept exploits.
TP-Link Systems Inc. products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15316 | | 2026-08-18 | An improper input validation vulnerability in the configuration service for processing encrypted credential data has been identified in Tapo C200 v5. An attac… | |
CVE-2026-15315 | | 2026-08-18 | Tapo C200 v5 contains an improper authentication vulnerability within the login authentication verification module. An attacker on the local network can exploi… | |
CVE-2026-15141 | | 2026-08-12 | The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Referer value, or omittin… | |
CVE-2025-30241 | | 2026-08-10 | Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level… | |
CVE-2025-30240 | | 2026-08-10 | The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supp… | |
CVE-2025-30239 | | 2026-08-10 | In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker… | |
CVE-2025-30238 | | 2026-08-10 | In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. … | |
CVE-2025-30237 | | 2026-08-10 | The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoin… | |
CVE-2026-12339 | | 2026-08-10 | A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An… | |
CVE-2026-9031 | | 2026-08-07 | An input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation of user-supplied data before it is processed by internal f… | |
CVE-2026-9030 | | 2026-08-07 | A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly sy… | |
CVE-2026-15314 | High | 7.5 | 2026-08-04 | Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient i… |
CVE-2025-15631 | Medium | 5.9 | 2026-08-03 | A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficien… |
CVE-2025-15630 | Medium | 5.9 | 2026-08-03 | A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimat… |
CVE-2025-15629 | High | 7.5 | 2026-08-03 | A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed dev… |
CVE-2025-15628 | High | 7.5 | 2026-08-03 | Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices. An… |
CVE-2025-15627 | High | 7.5 | 2026-08-03 | A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-coded cryptographic keys to establish trust and protect authentica… |
CVE-2025-15544 | Medium | 5.9 | 2026-08-03 | A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmit… |
CVE-2025-9291 | Medium | 6.5 | 2026-08-03 | A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not ad… |
CVE-2026-9044 | High | 8.0 | 2026-07-31 | An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to ex… |
CVE-2026-12935 | | 2026-07-29 | The TL-WR940N v6 router contains a vulnerability in its RTSP connection tracking module that can lead to a stack-based buffer overflow. The issue occurs when a… | |
CVE-2026-12001 | | 2026-07-27 | A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR20… | |
CVE-2026-9770 | Medium | 5.3 | 2026-07-15 | Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices. An attacker with… |
CVE-2026-13230 | Medium | 6.5 | 2026-07-15 | An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocatio… |
CVE-2026-5040 | Medium | 6.7 | 2026-07-14 | TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or pr… |
CVE-2026-15429 | High | 8.8 | 2026-07-14 | A privilege escalation vulnerability exists in the HTTP authentication component in Archer VX1800v v1. Improper handling of user-controlled input may allow new… |
CVE-2026-15428 | High | 8.8 | 2026-07-14 | An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who… |
CVE-2026-15427 | High | 8.1 | 2026-07-14 | An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitizati… |
CVE-2026-8699 | | 2026-07-02 | A stored Cross-Site Scripting (XSS) vulnerability has been identified in the web-based management interface of Archer C5 v6.8 routers, due to insufficient serv… | |
CVE-2026-10562 | | 2026-06-30 | An unauthenticated URL redirection vulnerability has been identified in Archer AX20 V2 due to improper validation of user-supplied URL input within the web int… | |
CVE-2026-9105 | Medium | 6.5 | 2026-06-29 | An authenticated stack-based buffer overflow vulnerability exists in the web management interface of TP-Link TL-WR841N v14. A remote authenticated attacker ca… |
CVE-2026-12760 | Medium | 6.5 | 2026-06-24 | A denial-of-service (DoS) vulnerability has been identified in Tapo C200 v3 in the network packet handling logic due to improper handling of IPv4 fragmented pa… |
CVE-2026-11834 | | 2026-06-22 | A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router models, due to insufficient validation of… | |
CVE-2026-11410 | High | 7.2 | 2026-06-17 | An authenticated OS command injection vulnerability exists in the BigPond Cable (BPA) WAN configuration module in TL-WR940N v6 due to improper sanitization of… |
CVE-2026-11409 | High | 7.2 | 2026-06-17 | An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due to improper sanitization of user input… |
CVE-2026-6250 | High | 8.1 | 2026-06-11 | An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to improper handling of user-controlled input. Externally control… |
CVE-2026-9151 | | 2026-06-10 | An OS command injection vulnerability exists in the VPN module of TP-Link Archer AX12 v1, AX17 v1. AX18 v1, and AX1300 v1.6 routers. This vulnerability allows… | |
CVE-2026-8913 | | 2026-06-08 | A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v5 due to improper neutralization of user-controlled input withi… | |
CVE-2026-6242 | | 2026-06-06 | An authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper handling of externally supplied parameters… | |
CVE-2026-6241 | | 2026-06-06 | An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly passed to formattin… | |
CVE-2026-6240 | | 2026-06-06 | A stack-based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF DeleteUsers service, due to insufficient boundary checks when handling multip… | |
CVE-2026-6239 | | 2026-06-06 | A stack‑based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF CreateUsers service, where the device fails to properly validate the number o… | |
CVE-2026-34123 | | 2026-06-06 | On Tapo C520WS v2, restricted accounts (for example, hub users) are intended to execute only a limited set of low‑sensitivity operations. Due to a logic flaw i… | |
CVE-2026-8714 | Medium | 6.5 | 2026-06-05 | A denial-of-service vulnerability exists in the RTSP server component of TP-Link Tapo C520WS v2 due to improper handling of syntactically invalid input. Craft… |
CVE-2026-1871 | Medium | 6.5 | 2026-06-02 | TP-Link Tapo C200 v5 contains a stack-based buffer overflow flaw in RTSP authentication handling due to improper validation of Authorization header field lengt… |
CVE-2026-34127 | Medium | 4.8 | 2026-05-29 | A stored cross-site scripting (XSS) vulnerability has been identified in the web management interface of TP-Link's TL-SG108PE v5 switch due to improper sanitat… |
CVE-2026-34126 | High | 7.5 | 2026-05-28 | TP-Link has identified a vulnerability in Tapo L535E v1.0 and v3.0, Tapo P300 v1.0, and Tapo D100C v1.0, where Bluetooth communication during the initial setup… |
CVE-2026-8697 | High | 8.8 | 2026-05-28 | Due to improper enforcement of authentication rate-limiting on a debug SSH service in Archer C64 v1, the SSH service allows unlimited authentication attempts a… |
CVE-2026-5509 | High | 7.2 | 2026-05-27 | An authenticated command injection vulnerability exists in the Archer BE450 v1 and BE7200 v1 router that allows an administrator to execute arbitrary system co… |
CVE-2026-3294 | High | 8.8 | 2026-05-22 | An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login param… |
CVE-2026-5511 | Low | 2.7 | 2026-05-19 | In the web management interface of Archer AX72 (SG) v1, the network diagnostic feature improperly handles invalid user input, resulting in limited exposure of… |
CVE-2026-5039 | High | 8.8 | 2026-04-23 | TP-Link TL-WR841N v13 uses DES-CBC encryption in the TDDPv2 debug protocol with a cryptographic key derived from default web management credentials, making the… |
CVE-2026-5363 | High | 8.8 | 2026-04-16 | Inadequate Encryption Strength vulnerability in TP-Link Archer C7 v5 and v5.8 (uhttpd modules) allows Password Recovery Exploitation. The web interface encrypt… |
CVE-2026-30818 | High | 8.0 | 2026-04-08 | An OS command injection vulnerability in the dnsmasq module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute arbitrary code whe… |
CVE-2026-30817 | Medium | 5.7 | 2026-04-08 | An external configuration control vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary files wh… |
CVE-2026-30816 | Medium | 5.7 | 2026-04-08 | An external control of configuration vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary file… |
CVE-2026-30815 | High | 8.0 | 2026-04-08 | An OS command injection vulnerability in the OpenVPN module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute system commands wh… |
CVE-2026-30814 | High | 8.0 | 2026-04-08 | A stack-based buffer overflow in the tmpServer module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to trigger a segmentation fault and… |
CVE-2026-34124 | Medium | 6.5 | 2026-04-02 | A denial-of-service vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP request path parsing logic. The implementation enforces length res… |
CVE-2026-34122 | Medium | 6.5 | 2026-04-02 | A stack-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within a configuration handling component due to insufficient input vali… |
CVE-2026-34121 | High | 8.8 | 2026-04-02 | An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 was identified, due to inconsistent… |
CVE-2026-34120 | Medium | 6.5 | 2026-04-02 | A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the asynchronous parsing of local video stream content due to insu… |
CVE-2026-34119 | Medium | 6.5 | 2026-04-02 | A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing loop when appending segmented request bodies with… |
CVE-2026-34118 | Medium | 6.5 | 2026-04-02 | A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 in the HTTP POST body parsing logic due to missing validation of remainin… |
CVE-2026-4346 | Medium | 6.8 | 2026-03-26 | The vulnerability affecting TL-WR850N v3 allows cleartext storage of administrative and Wi-Fi credentials in a region of the device’s flash memory while the se… |
CVE-2026-3622 | High | 7.5 | 2026-03-26 | The vulnerability exists in the UPnP component of TL-WR841N v14, where improper input validation leads to an out-of-bounds read, potentially causing a crash of… |
CVE-2025-15606 | High | 7.5 | 2026-03-23 | A Denial-of-Service (DoS) vulnerability in the httpd component of TP-Link's TD-W8961N v4.0 due to improper input sanitization, allows crafted requests to trigg… |
CVE-2025-15605 | High | 7.3 | 2026-03-23 | A hardcoded cryptographic key within the configuration mechanism on TP-Link Archer NX200, NX210, NX500 and NX600 enables decryption and re-encryption of device… |
CVE-2025-15519 | High | 7.2 | 2026-03-23 | Improper input handling in a modem-management administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as… |
CVE-2025-15518 | High | 7.2 | 2026-03-23 | Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as… |
CVE-2025-15517 | High | 8.1 | 2026-03-23 | A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intend… |
CVE-2025-15608 | Critical | 9.8 | 2026-03-20 | This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results from insufficient input sanitization in the device’s probe handling logic, where unvalidated param… |
CVE-2025-15607 | Critical | 9.8 | 2026-03-20 | A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling, allowing log redirection to arbitrary files… |
CVE-2026-3227 | Medium | 6.8 | 2026-03-16 | A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements us… |
CVE-2026-1668 | Critical | 9.8 | 2026-03-13 | The web interface on multiple Omada switches does not adequately validate certain external inputs, which may lead to out-of-bound memory access when processing… |
CVE-2026-3841 | High | 8.8 | 2026-03-12 | A command injection vulnerability has been identified in the Telnet command-line interface (CLI) of TP-Link TL-MR6400 v5.3. This issue is caused by insufficie… |
CVE-2025-15568 | High | 8.0 | 2026-03-09 | A command injection vulnerability was identified in the web module of Archer AXE75 v1.6/v1.0 router. An authenticated attacker with adjacent-network access ma… |
CVE-2025-7375 | Medium | 6.5 | 2026-03-05 | A denial-of-service (DoS) vulnerability was identified in Omada EAP610 v3. An attacker with adjacent network access can send crafted requests to cause the dev… |
CVE-2026-0655 | High | 8.0 | 2026-03-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TP-Link Deco BE25 v1.0 (web modules) allows authenticated adjac… |
CVE-2026-0654 | High | 8.0 | 2026-03-02 | Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authent… |
CVE-2025-9293 | High | 8.1 | 2026-02-13 | A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communicati… |
CVE-2025-9292 | High | 7.5 | 2026-02-13 | A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitat… |
CVE-2026-1571 | Medium | 6.1 | 2026-02-11 | User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted… |
CVE-2026-0653 | Medium | 6.5 | 2026-02-10 | On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization… |
CVE-2026-0652 | High | 8.8 | 2026-02-10 | On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. A… |
CVE-2026-0651 | High | 7.8 | 2026-02-10 | A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The ser… |
CVE-2025-15557 | High | 8.8 | 2026-02-05 | An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept a… |
CVE-2025-15551 | Medium | 5.6 | 2026-02-05 | The response coming from TP-Link Archer MR200 v5.2, C20 v5 and v6, TL-WR850N v3, and TL-WR845N v4 for any request is getting executed by the JavaScript functio… |
CVE-2026-0620 | | 2026-02-03 | When configured as L2TP/IPSec VPN server, Archer AXE75 V1 may accept connections using L2TP without IPSec protection, even when IPSec is enabled. This allows… | |
CVE-2025-62673 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tdpserver modules) allows adjacent attackers to cause a segmentation fault or potentially… |
CVE-2025-62501 | High | 8.1 | 2026-02-03 | SSH Hostkey misconfiguration vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows attackers to obtain device credentials through a specially cr… |
CVE-2025-62405 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-62404 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-61983 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-61944 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-59487 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-59482 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-58455 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-58077 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2026-22228 | Medium | 4.9 | 2026-02-03 | An authenticated user with high privileges may trigger a denial‑of‑service condition in TP-Link Archer BE230 v1.2 by restoring a crafted configuration file con… |