Medium 6.3Published Aug 20, 2026

CVE-2026-19683Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways

Updated under an hour ago (Oct 26, 2026, 2:30 PM ET)

Does this affect you?

It affects TP-Link Systems Inc. ER7212PC v2 and 36 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for TP-Link Systems Inc. ER7212PC v2

Exploited in the last 30 days

A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path. Successful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment.

CVSS: 6.3 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-319
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: TPLink
NVD analysis: Analyzed
Record last updated: Aug 20, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

TP-Link Systems Inc. ER7212PC v2 tp_link_systems:er7212pc_v2 (from the name)	before 2.4.3 Build 20260722 Rel.40250	CNA record
TP-Link Systems Inc. ER605 v2 tp_link_systems:er605_v2 (from the name)	before 2.4.4 Build 20260630 Rel.14398	CNA record
TP-Link Systems Inc. ER7206 v2 tp_link_systems:er7206_v2 (from the name)	before 2.3.5 Build 20260625 Rel.43136	CNA record
TP-Link Systems Inc ER7406 v1 tp_link_systems:er7406_v1 (from the name)	before 1.3.4 Build 20260625 Rel.43136	CNA record
TP-Link Systems Inc. ER707-M2 v1 tp_link_systems:er707_m2_v1 (from the name)	before 1.4.4 Build 20260625 Rel.43063	CNA record
TP-Link Systems Inc ER7412-M2 v1 tp_link_systems:er7412_m2_v1 (from the name)	before 1.2.0 Build 20260630 Rel.82947	CNA record
TP-Link Systems Inc. ER8411 v1 tp_link_systems:er8411_v1 (from the name)	before 1.4.1 Build 20260708 Rel.64832	CNA record
TP-Link Systems Inc. ER706W v1 tp_link_systems:er706w_v1 (from the name)	before 1.2.11 Build 20260723 Rel.41567	CNA record
TP-Link Systems Inc. v1 tp_link_systems:v1 (from the name)	before 1.2.6 Build 20260723 Rel.41321	CNA record
TP-Link Systems Inc. ER706W-4G v2 tp_link_systems:er706w_4g_v2 (from the name)	before 2.1.11 Build 20260723 Rel.41624	CNA record
1–10 of 37

References

References

https://www.omadanetworks.com/en/support/download/	patch, product
https://www.omadanetworks.com/us/support/download/	patch, product
https://www.tp-link.com/us/support/faq/5256/	vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.