Critical 9.3Published Oct 20, 2025

CVE-2025-7850Authenticated OS command execution

Updated under an hour ago (Oct 27, 2026, 11:20 AM ET)

Does this affect you?

It affects TP-Link Systems Inc. Omada gateways and 15 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for TP-Link Systems Inc. Omada gateways

Exploited in the last 30 days

A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.

CVSS: 9.3 CRITICAL (v4.0, CNA)CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H
Weakness (CWE): CWE-78
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: TPLink
NVD analysis: Modified
Record last updated: Oct 24, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

TP-Link Systems Inc. Omada gateways tp_link_systems:omada_gateways (from the name)	before ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3	CNA record
TP-Link Systems Inc. Festa gateways tp_link_systems:festa_gateways (from the name)	before FR365 1.1.10, FR205 1.0.3, FR307 1.2.5	CNA record
TP-Link Systems Inc. Omada Pro gateways tp_link_systems:omada_pro_gateways (from the name)	before G36 1.1.4, G611 1.2.2	CNA record
tp-link er8411_firmware tp-link:er8411_firmware	before 1.3.3; 1.3.3	NVD
tp-link er7412-m2_firmware tp-link:er7412-m2_firmware	before 1.1.0; 1.1.0	NVD
tp-link er707-m2_firmware tp-link:er707-m2_firmware	before 1.3.1; 1.3.1	NVD
tp-link er7206_firmware tp-link:er7206_firmware	before 2.2.2; 2.2.2	NVD
tp-link er605_firmware tp-link:er605_firmware	before 2.3.1; 2.3.1	NVD
tp-link er706w_firmware tp-link:er706w_firmware	before 1.2.1; 1.2.1	NVD
tp-link er706w-4g_firmware tp-link:er706w-4g_firmware	before 1.2.1; 1.2.1	NVD
1–10 of 16

References

References

https://support.omadanetworks.com/en/document/108456/	vendor-advisory
https://www.omadanetworks.com/us/business-networking/all-omada-router/	product
https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/	product
https://www.tp-link.com/us/business-networking/soho-festa-gateway/	product
https://www.forescout.com/blog/new-tp-link-router-vulnerabilities-a-primer-on-rooting-routers/

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.