Multiple vulnerabilities in TP-Link Omada system could lead to root access

Summary: Cisco Talos disclosed vulnerabilities across TP-Link Omada devices, including a stack-based buffer overflow in the EAP225 V3 web interface that can lead to remote code execution and unauthenticated TDDP flaws that can factory reset a device or, via the enableTestMode command, force it to fetch and run a script as root. The ER7206 Omada Gigabit VPN Router carries eight post-authentication command injection vulnerabilities in VPN configuration functions such as PPTP, GRE, WireGuard and IPsec, and TP-Link released patches in February and April 2024.
Key Takeaway: The TDDP issues need no credentials: the service listens on UDP 1040 for the first 15 minutes after every restart, and a single request can reset a device or pull root-level code from a host at 192.168.0.100. Eight authenticated command injections on the ER7206 also hand an attacker an unrestricted shell, a foothold for persistence on the VPN gateway itself.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-36498 CVE-2023-42664 CVE-2023-43482 CVE-2023-46683 CVE-2023-47167 CVE-2023-47209 CVE-2023-47617 CVE-2023-47618 CVE-2023-48724 CVE-2023-49074 CVE-2023-49133 CVE-2023-49134 CVE-2023-49906 CVE-2023-49913
Related: Vulnerability in some TP-Link routers could lead to factory reset Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026