Full Report
TP-Link has made firmware updates available for a broad range of Omada gateway models to address four vulnerabilities, among which a critical pre-auth OS command injection. [...]
Analysis Summary
# Vulnerability: Command Injection in TP-Link Omada Gateways (CVE-2025-6542 & CVE-2025-6541)
## CVE Details
- CVE ID: CVE-2025-6542, CVE-2025-6541 (Also mentions related CVEs: CVE-2025-8750, CVE-2025-7851)
- CVSS Score: 9.3 (Critical) for CVE-2025-6542; 8.6 (High) for CVE-2025-6541
- CWE: Not explicitly stated, but implied Command Injection (CWE-78 variants).
## Affected Systems
- Products: TP-Link Omada Gateways (Multiple Models)
- Versions: Specific firmware versions listed below.
- Configurations:
- CVE-2025-6542: Exploitable remotely without authentication.
- CVE-2025-6541: Requires an attacker to be able to log in to the web management interface.
| Model | Affected Version | Fixed Version |
| :--- | :--- | :--- |
| ER8411 | <= 1.3.3 Build 20251013 Rel.44647 | 1.3.3 Build 20251013 Rel.44647 (Implied fixed version is the next release) |
| ER7412-M2 | <= 1.1.0 Build 20251015 Rel.63594 | |
| ER707-M2 | <= 1.3.1 Build 20251009 Rel.67687 | |
| ER7206 | <= 2.2.2 Build 20250724 Rel.11109 | |
| ER605 | <= 2.3.1 Build 20251015 Rel.78291 | |
| ER706W | <= 1.2.1 Build 20250821 Rel.80909 | |
| ER706W-4G | <= 1.2.1 Build 20250821 Rel.82492 | |
| ER7212PC | <= 2.1.3 Build 20251016 Rel.82571 | |
| G36 | <= 1.1.4 Build 20251015 Rel.84206 | |
| G611 | <= 1.2.2 Build 20251017 Rel.45512 | |
| FR365 | <= 1.1.10 Build 20250626 Rel.81746 | |
| FR205 | <= 1.0.3 Build 20251016 Rel.61376 | |
| FR307-M2 | <= 1.2.5 Build 20251015 Rel.76743 | |
*Note: The article states that the latest firmware release addresses all four vulnerabilities, implying that these listed versions are vulnerable.*
## Vulnerability Description
The vulnerabilities are command injection flaws affecting TP-Link Omada gateway devices. Successful exploitation allows an attacker to execute arbitrary commands on the device's underlying operating system.
- **CVE-2025-6542 (Critical, 9.3):** Allows remote, unauthenticated attackers to achieve command execution.
- **CVE-2025-6541 (High, 8.6):** Allows authenticated users (those logged into the web management interface) to achieve command execution.
The potential impact is significant, leading to full device compromise, data theft, lateral movement within the network, and persistence.
## Exploitation
- Status: Details on exploitation status are not explicitly provided, but the existence of low-complexity unauthenticated remote exploitation vector (CVE-2025-6542) suggests high risk.
- Complexity: Low (for CVE-2025-6542).
- Attack Vector: Network (Remote/Unauthenticated). The authenticated flaw requires local access to the management interface.
## Impact
- Confidentiality: High (Potential for data theft and system access)
- Integrity: High (Arbitrary OS command execution allows modification or destruction of system data)
- Availability: High (Full system compromise can lead to denial of service or device tampering)
## Remediation
### Patches
TP-Link has released firmware updates addressing these issues. Users should upgrade to the latest available firmware for their respective models. The latest release addresses all four reported vulnerabilities.
### Workarounds
1. Ensure that only trusted users have access to the Omada web management interface.
2. Apply necessary network access controls (e.g., firewall rules) to restrict access to the management interface only from necessary internal sources (especially relevant for CVE-2025-6541).
## Detection
- Indicators of Compromise: Look for unusual process execution originating from the gateway, unexpected network connections initiated by the gateway, or configuration changes not initiated by administrators.
- Detection Methods and Tools: Monitor system logs on the gateway for signs of command injection attempts or unexpected shell activity. Network intrusion detection systems (NIDS) should be configured to watch for command injection payloads traversing the network interface, particularly towards ports used by the web management interface.
## References
- Vendor Advisory (Command Injection Flaws): support dot omdanenetworks dot com slash en slash document slash 108455
- Vendor Advisory (Authenticated Flaws): support dot omdanenetworks dot com slash us slash document slash 108456