Tp-Link Er7206 Firmware
14 CVEs affecting Tp-Link Er7206 Firmware. Latest disclosed: 2026-01-23. Critical: 2, High: 11.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-7851 | Critical | 9.8 | 2025-10-21 | An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways. |
CVE-2025-6542 | Critical | 9.8 | 2025-10-21 | An arbitrary OS command may be executed on the product by a remote unauthenticated attacker. |
CVE-2025-6541 | High | 8.8 | 2025-10-21 | An arbitrary OS command may be executed on the product by the user who can log in to the web management interface. |
CVE-2025-7850 | High | 7.2 | 2025-10-21 | A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways. |
CVE-2024-21827 | High | 7.2 | 2024-06-25 | A leftover debug code vulnerability exists in the cli_server debug functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.4.1 Build 20240117 Rel.57421. A s… |
CVE-2023-47618 | High | 7.2 | 2024-02-06 | A post authentication command execution vulnerability exists in the web filtering functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322… |
CVE-2023-47617 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists when configuring the web group member of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230… |
CVE-2023-47209 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322… |
CVE-2023-47167 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists in the GRE policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Re… |
CVE-2023-46683 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists when configuring the wireguard VPN functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0… |
CVE-2023-43482 | High | 7.2 | 2024-02-06 | A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A speci… |
CVE-2023-42664 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 bui… |
CVE-2023-36498 | High | 7.2 | 2024-02-06 | A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 R… |
CVE-2025-9290 | Medium | 5.9 | 2026-01-23 | An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random value… |