A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.
Successful exploitation may allow arbitrary command execution, potentially
leading to full compromise of the affected device.
Successful exploitation may allow arbitrary command execution, potentially
leading to full compromise of the affected device.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| TP-Link Systems Inc. | ER7212PC v2 | unaffected |
|
||||||
| TP-Link Systems Inc. | ER605 v2 | unaffected |
|
||||||
| TP-Link Systems Inc. | ER7206 v2 | unaffected |
|
||||||
| TP-Link Systems Inc | ER7406 v1 | unaffected |
|
||||||
| TP-Link Systems Inc. | ER707-M2 v1 | unaffected |
|
||||||
| TP-Link Systems Inc | ER7412-M2 v1 | unaffected |
|
||||||
| TP-Link Systems Inc. | ER8411 v1 | unaffected |
|
||||||
| TP-Link Systems Inc. | ER706W v1 | unaffected |
|
||||||
| TP-Link Systems Inc. | v1 | unaffected |
|
||||||
| TP-Link Systems Inc. | ER706W-4G v2 | unaffected |
|
||||||
| TP-Link Systems Inc. | ER706WP-4G v1 | unaffected |
|
||||||
| TP-Link Systems Inc. | ER703WP-4G-Outdoor v1 | unaffected |
|
||||||
| TP-Link Systems Inc. | DR3220v-4G v1 | unaffected |
|
||||||
| TP-Link Systems Inc. | DR3650v v1 | unaffected |
|
||||||
| TP-Link Systems Inc. | DR3650v-4G v1 | unaffected |
|
||||||
| TP-Link Systems Inc. | ER603WP-4G-Outdoor v1 | unaffected |
|
||||||
| TP-Link Systems Inc. | DR3150 v1 | unaffected |
|
||||||
| TP-Link Systems Inc. | ER701-5G-Outdoor v1 | unaffected |
|
||||||
| TP-Link Systems Inc. | ER605W v2 | unaffected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|---|
|
Tp-link
Subscribe
|
Dr3150 V1
Subscribe
Dr3220v-4g V1
Subscribe
Dr3650v-4g V1
Subscribe
Dr3650v V1
Subscribe
Er603wp-4g-outdoor V1
Subscribe
Er605 V2
Subscribe
Er605w V2
Subscribe
Er701-5g-outdoor
Subscribe
Er703wp-4g-outdoor
Subscribe
Er706w-4g V2
Subscribe
Er706w V1
Subscribe
Er706wp-4g V1
Subscribe
Er707-m2 V1
Subscribe
Er7206 V2
Subscribe
Er7212pc V2
Subscribe
Er7406 V1
Subscribe
Er8411 V1
Subscribe
V1
Subscribe
|
|
Tp-link Systems Inc
Subscribe
|
Er7412-m2 V1
Subscribe
|
Project Subscriptions
| Vendors | Products |
|---|---|
|
Tp-link
Subscribe
|
Dr3150 V1
Subscribe
Dr3220v-4g V1
Subscribe
Dr3650v-4g V1
Subscribe
Dr3650v V1
Subscribe
Er603wp-4g-outdoor V1
Subscribe
Er605 V2
Subscribe
Er605w V2
Subscribe
Er701-5g-outdoor
Subscribe
Er703wp-4g-outdoor
Subscribe
Er706w-4g V2
Subscribe
Er706w V1
Subscribe
Er706wp-4g V1
Subscribe
Er707-m2 V1
Subscribe
Er7206 V2
Subscribe
Er7212pc V2
Subscribe
Er7406 V1
Subscribe
Er8411 V1
Subscribe
V1
Subscribe
|
|
Tp-link Systems Inc
Subscribe
|
Er7412-m2 V1
Subscribe
|
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 21 Aug 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Tp-link
Tp-link dr3150 V1 Tp-link dr3220v-4g V1 Tp-link dr3650v-4g V1 Tp-link dr3650v V1 Tp-link er603wp-4g-outdoor V1 Tp-link er605 V2 Tp-link er605w V2 Tp-link er701-5g-outdoor Tp-link er703wp-4g-outdoor Tp-link er706w-4g V2 Tp-link er706w V1 Tp-link er706wp-4g V1 Tp-link er707-m2 V1 Tp-link er7206 V2 Tp-link er7212pc V2 Tp-link er7406 V1 Tp-link er8411 V1 Tp-link v1 Tp-link Systems Inc Tp-link Systems Inc er7412-m2 V1 |
|
| Vendors & Products |
Tp-link
Tp-link dr3150 V1 Tp-link dr3220v-4g V1 Tp-link dr3650v-4g V1 Tp-link dr3650v V1 Tp-link er603wp-4g-outdoor V1 Tp-link er605 V2 Tp-link er605w V2 Tp-link er701-5g-outdoor Tp-link er703wp-4g-outdoor Tp-link er706w-4g V2 Tp-link er706w V1 Tp-link er706wp-4g V1 Tp-link er707-m2 V1 Tp-link er7206 V2 Tp-link er7212pc V2 Tp-link er7406 V1 Tp-link er8411 V1 Tp-link v1 Tp-link Systems Inc Tp-link Systems Inc er7412-m2 V1 |
Thu, 20 Aug 2026 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 20 Aug 2026 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt. Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device. | |
| Title | Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways | |
| Weaknesses | CWE-78 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: TPLink
Published:
Updated: 2026-08-21T03:56:42.164Z
Reserved: 2026-08-12T00:06:23.069Z
Link: CVE-2026-19586
Vulnrichment
Updated: 2026-08-20T18:58:14.851Z
NVD
Status : Received
Published: 2026-08-20T19:16:51.103
Modified: 2026-08-21T04:18:02.220
Link: CVE-2026-19586
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-21T14:45:16Z
Weaknesses