TP-Link Systems Inc.
Page 2 of 2 — TP-Link Systems Inc. CVEs from a corpus of 193, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-15606 | High | 7.5 | 2026-03-23 | A Denial-of-Service (DoS) vulnerability in the httpd component of TP-Link's TD-W8961N v4.0 due to improper input sanitization, allows crafted requests to trigg… |
CVE-2025-15605 | High | 7.3 | 2026-03-23 | A hardcoded cryptographic key within the configuration mechanism on TP-Link Archer NX200, NX210, NX500 and NX600 enables decryption and re-encryption of device… |
CVE-2025-15519 | High | 7.2 | 2026-03-23 | Improper input handling in a modem-management administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as… |
CVE-2025-15518 | High | 7.2 | 2026-03-23 | Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as… |
CVE-2025-15517 | High | 8.1 | 2026-03-23 | A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intend… |
CVE-2025-15608 | Critical | 9.8 | 2026-03-20 | This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results from insufficient input sanitization in the device’s probe handling logic, where unvalidated param… |
CVE-2025-15607 | Critical | 9.8 | 2026-03-20 | A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling, allowing log redirection to arbitrary files… |
CVE-2026-3227 | Medium | 6.8 | 2026-03-16 | A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements us… |
CVE-2026-1668 | Critical | 9.8 | 2026-03-13 | The web interface on multiple Omada switches does not adequately validate certain external inputs, which may lead to out-of-bound memory access when processing… |
CVE-2026-3841 | High | 8.8 | 2026-03-12 | A command injection vulnerability has been identified in the Telnet command-line interface (CLI) of TP-Link TL-MR6400 v5.3. This issue is caused by insufficie… |
CVE-2025-15568 | High | 8.0 | 2026-03-09 | A command injection vulnerability was identified in the web module of Archer AXE75 v1.6/v1.0 router. An authenticated attacker with adjacent-network access ma… |
CVE-2025-7375 | Medium | 6.5 | 2026-03-05 | A denial-of-service (DoS) vulnerability was identified in Omada EAP610 v3. An attacker with adjacent network access can send crafted requests to cause the dev… |
CVE-2026-0655 | High | 8.0 | 2026-03-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TP-Link Deco BE25 v1.0 (web modules) allows authenticated adjac… |
CVE-2026-0654 | High | 8.0 | 2026-03-02 | Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authent… |
CVE-2025-9293 | High | 8.1 | 2026-02-13 | A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communicati… |
CVE-2025-9292 | High | 7.5 | 2026-02-13 | A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitat… |
CVE-2026-1571 | Medium | 6.1 | 2026-02-11 | User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted… |
CVE-2026-0653 | Medium | 6.5 | 2026-02-10 | On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization… |
CVE-2026-0652 | High | 8.8 | 2026-02-10 | On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. A… |
CVE-2026-0651 | High | 7.8 | 2026-02-10 | A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The ser… |
CVE-2025-15557 | High | 8.8 | 2026-02-05 | An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept a… |
CVE-2025-15551 | Medium | 5.6 | 2026-02-05 | The response coming from TP-Link Archer MR200 v5.2, C20 v5 and v6, TL-WR850N v3, and TL-WR845N v4 for any request is getting executed by the JavaScript functio… |
CVE-2026-0620 | | 2026-02-03 | When configured as L2TP/IPSec VPN server, Archer AXE75 V1 may accept connections using L2TP without IPSec protection, even when IPSec is enabled. This allows… | |
CVE-2025-62673 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in Archer AX53 v1.0 and AX12 v1.0 (tdpserver modules) allows adjacent attackers to cause a segmentation fault or poten… |
CVE-2025-62501 | High | 8.1 | 2026-02-03 | SSH Hostkey misconfiguration vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows attackers to obtain device credentials through a specially cr… |
CVE-2025-62405 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-62404 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-61983 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-61944 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-59487 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-59482 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-58455 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2025-58077 | High | 8.0 | 2026-02-03 | Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault… |
CVE-2026-22228 | Medium | 4.9 | 2026-02-03 | An authenticated user with high privileges may trigger a denial‑of‑service condition in TP-Link Archer BE230 v1.2 by restoring a crafted configuration file con… |
CVE-2026-22220 | Medium | 4.5 | 2026-02-03 | A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web modules) may allow a crafted request to cause the device’s web… |
CVE-2026-22229 | High | 7.2 | 2026-02-02 | A command injection vulnerability may be exploited after the admin's authentication via the import of a crafted VPN client configuration file on the TP-Link Ar… |
CVE-2026-22227 | High | 7.2 | 2026-02-02 | A command injection vulnerability may be exploited after the admin's authentication via the configuration backup restoration function of the TP-Link Archer BE2… |
CVE-2026-22226 | High | 7.2 | 2026-02-02 | A command injection vulnerability may be exploited after the admin's authentication in the VPN server configuration module on TP-Link Archer BE230 v1.2 and Arc… |
CVE-2026-22225 | High | 7.2 | 2026-02-02 | A command injection vulnerability may be exploited after the admin's authentication in the VPN Connection Service on the Archer BE230 v1.2 and Archer AXE75 v1… |
CVE-2026-22224 | High | 7.2 | 2026-02-02 | A command injection vulnerability may be exploited after the admin's authentication in the cloud communication interface on the TP-Link Archer BE230 v1.2. Succ… |
CVE-2026-22223 | High | 8.0 | 2026-02-02 | An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and BE3600 v1 (vpn modules) allows adjacent authenticated attacker execute arbitrary c… |
CVE-2026-22222 | High | 8.0 | 2026-02-02 | An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and Archer AXE75 v2 (web modules) allows adjacent authenticated attacker to execute arbi… |
CVE-2026-22221 | High | 8.0 | 2026-02-02 | An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) and BE3600 v1 allows adjacent authenticated attacker execute arbitrary co… |
CVE-2026-0631 | High | 8.0 | 2026-02-02 | An OS Command Injection vulnerability exists in the Surfshark VPN login functionality in TP-Link Archer BE230 v1.2, BE3600v1 and AXE75 v1, allowing an adjacent… |
CVE-2026-0630 | High | 8.0 | 2026-02-02 | An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(web modules) and Archer AXE75 v1.0 allows adjacent authenticated attacker to execute arb… |
CVE-2026-1457 | High | 8.8 | 2026-01-29 | An authenticated buffer handling flaw in TP-Link VIGI C385 V1 Web API lacking input sanitization, may allow memory corruption leading to remote code execution… |
CVE-2025-15548 | Medium | 6.5 | 2026-01-29 | Some VX800v v1.0 web interface endpoints transmit sensitive information over unencrypted HTTP due to missing application layer encryption, allowing a network a… |
CVE-2025-15543 | Medium | 4.6 | 2026-01-29 | Improper link resolution in USB HTTP access path in VX800v v1.0 allows a crafted USB device to expose root filesystem contents, giving an attacker with physica… |
CVE-2025-15542 | Medium | 5.3 | 2026-01-29 | Improper handling of exceptional conditions in VX800v v1.0 in SIP processing allows an attacker to flood the device with crafted INVITE messages, blocking all… |
CVE-2025-15541 | Medium | 6.3 | 2026-01-29 | Improper link resolution in the VX800v v1.0 SFTP service allows authenticated adjacent attackers to use crafted symbolic links to access system files, resultin… |
CVE-2025-13399 | High | 8.8 | 2026-01-29 | A weakness in the web interface’s application layer encryption in VX800v v1.0 allows an adjacent attacker to brute force the weak AES key and decrypt intercept… |
CVE-2025-15545 | Medium | 6.8 | 2026-01-29 | The backup restore function does not properly validate unexpected or unrecognized tags within the backup file. When such a crafted file is restored, the inject… |
CVE-2026-1315 | High | 7.5 | 2026-01-27 | By sending crafted files to the firmware update endpoint of Tapo C220 v1 and C520WS v2, the device terminates core system services before verifying authenticat… |
CVE-2026-0919 | High | 7.5 | 2026-01-27 | The HTTP parser of Tapo C210 v3, C220 v1 and C520WS v2 cameras improperly handles requests containing an excessively long URL path. An invalid‑URL error path c… |
CVE-2026-0918 | High | 7.5 | 2026-01-27 | The Tapo C100 v5, C220 v1 and C520WS v2 cameras’ HTTP service does not safely handle POST requests containing an excessively large Content-Length header. The r… |
CVE-2025-9522 | Medium | 5.3 | 2026-01-26 | Blind Server-Side Request Forgery (SSRF) in Omada Controllers through webhook functionality, enabling crafted requests to internal services, which may lead to… |
CVE-2025-9521 | Medium | 6.5 | 2026-01-26 | Password Confirmation Bypass vulnerability in Omada Controllers, allowing an attacker with a valid session token to bypass secondary verification, and change t… |
CVE-2025-9520 | Medium | 6.8 | 2026-01-26 | An IDOR vulnerability exists in Omada Controllers that allows an attacker with Administrator permissions to manipulate requests and potentially hijack the Owne… |
CVE-2025-14756 | High | 8.8 | 2026-01-26 | Command injection vulnerability was found in the admin interface component of TP-Link Archer MR600 v5 firmware, allowing authenticated attackers to execute sys… |
CVE-2025-9290 | Medium | 5.9 | 2026-01-23 | An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random value… |
CVE-2025-9289 | Medium | 4.7 | 2026-01-22 | A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advance… |
CVE-2026-0834 | High | 8.8 | 2026-01-21 | Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute admini… |
CVE-2026-0629 | | 2026-01-16 | Authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models allows an attacker on the LAN to reset the… | |
CVE-2025-9014 | High | 7.5 | 2026-01-15 | A Null Pointer Dereference vulnerability exists in the referer header check of the web portal of TP-Link TL-WR841N v14, caused by improper input validation. A… |
CVE-2025-15035 | High | 7.3 | 2026-01-09 | Improper Input Validation vulnerability in TP-Link Archer AXE75 v1.6 (vpn modules) allows an authenticated adjacent attacker to delete arbitrary server file, l… |
CVE-2025-14631 | Medium | 6.5 | 2026-01-07 | A NULL Pointer Dereference vulnerability in TP-Link Archer BE400 V1(802.11 modules) allows an adjacent attacker to cause a denial-of-service (DoS) by trigger… |
CVE-2025-14175 | Medium | 6.5 | 2025-12-29 | A vulnerability in the SSH server of TP-Link TL-WR820N v2.80 allows the use of a weak cryptographic algorithm, enabling an adjacent attacker to intercept and d… |
CVE-2025-8065 | Medium | 6.5 | 2025-12-20 | A stack-based buffer overflow vulnerability was identified in the ONVIF SOAP XML Parser in Tapo C200 v3 and C520WS v2.6. When processing XML tags with namespac… |
CVE-2025-14300 | High | 8.1 | 2025-12-20 | The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the s… |
CVE-2025-14299 | Medium | 6.5 | 2025-12-20 | The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on th… |
CVE-2025-14739 | | 2025-12-18 | Access of Uninitialized Pointer vulnerability in TP-Link WR940N and WR941ND allows local unauthenticated attackers the ability to execute DoS attack and pote… | |
CVE-2025-14738 | High | 7.5 | 2025-12-18 | Improper authentication vulnerability in TP-Link WA850RE (httpd modules) allows unauthenticated attackers to download the configuration file.This issue affects… |
CVE-2025-14737 | High | 8.0 | 2025-12-18 | Command Injection vulnerability in TP-Link WA850RE (httpd modules) allows authenticated adjacent attacker to inject arbitrary commands.This issue affects: ≤ WA… |
CVE-2025-14553 | | 2025-12-16 | Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo cameras, allowing attackers to brute force… | |
CVE-2025-7851 | Critical | 9.8 | 2025-10-21 | An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways. |
CVE-2025-7850 | High | 7.2 | 2025-10-21 | A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways. |
CVE-2025-6542 | Critical | 9.8 | 2025-10-21 | An arbitrary OS command may be executed on the product by a remote unauthenticated attacker. |
CVE-2025-6541 | High | 8.8 | 2025-10-21 | An arbitrary OS command may be executed on the product by the user who can log in to the web management interface. |
CVE-2025-10991 | | 2025-09-30 | The attacker may obtain root access by connecting to the UART port and this vulnerability requires the attacker to have the physical access to the device. Thi… | |
CVE-2025-9961 | | 2025-09-06 | An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500. The exploit can only be conducted via a Man… | |
CVE-2025-9377 | High | 7.2 | 2025-08-29 | The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9. This… |
CVE-2025-8627 | High | 8.8 | 2025-08-25 | The TP-Link KP303 Smartplug can be issued unauthenticated protocol commands that may cause unintended power-off condition and potential information leak. This… |
CVE-2025-53715 | High | 7.5 | 2025-07-29 | A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/Wan6to4TunnelCfgRpm.htm file due to missing input parameter v… |
CVE-2025-53714 | High | 7.5 | 2025-07-29 | A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WzdWlanSiteSurveyRpm_AP.htm file due to missing input paramet… |
CVE-2025-53713 | High | 7.5 | 2025-07-29 | A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WlanNetworkRpm_APC.htm file due to missing input parameter va… |
CVE-2025-53712 | High | 7.5 | 2025-07-29 | A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WlanNetworkRpm_AP.htm file due to missing input parameter val… |
CVE-2025-53711 | High | 7.5 | 2025-07-29 | A vulnerability has been found in TP-Link TL-WR841N v11, TL-WR842ND v2 and TL-WR494N v3. The vulnerability exists in the /userRpm/WlanNetworkRpm.htm file due t… |
CVE-2025-7724 | | 2025-07-22 | An unauthenticated OS command injection vulnerability exists in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1: before 1… | |
CVE-2025-7723 | | 2025-07-22 | A command injection vulnerability exists that can be exploited after authentication in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NV… | |
CVE-2025-6982 | | 2025-07-16 | Use of Hard-coded Credentials in TP-Link Archer C50 V3( <= 180703)/V4( <= 250117 )/V5( <= 200407 ), and C20 V5 (<US_V5_260419 or <EU_V5_260317) all… | |
CVE-2025-6151 | | 2025-06-17 | A vulnerability has been found in TP-Link TL-WR940N V4 and TL-WR841N V11. Affected by this issue is some unknown functionality of the file /userRpm/WanSlaacC… | |
CVE-2025-4975 | | 2025-05-22 | When a notification relating to low battery appears for a user with whom the device has been shared, tapping the notification grants full access to the power s… | |
CVE-2025-25427 | Medium | 5.4 | 2025-04-18 | A stored cross-site scripting (XSS) vulnerability in the upnp.htm page of the web Interface in TP-Link WR841N v14/v14.6/v14.8 <= Build 241230 Rel. 50788n allow… |