CyberSecBulletin
CVE-2026-19586NVD status: Analyzed

ER7212PC v2: Improper Neutralization of Special Elements used in an OS Command

Published Updated By the CyberSecBulletin desk

CVE-2026-19586 is a critical-severity improper neutralization of special elements used in an OS command vulnerability in ER7212PC v2 from TP-Link, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists version 2.4.3 Build 20260722 Rel.40250 as the first without the flaw, so updating ER7212PC v2 to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 5.77% chance of exploitation within 30 days, which is in the top 6.79% of all scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update ER7212PC v2 to 2.4.3 Build 20260722 Rel.40250 or a later version.
  2. Update ER605 v2 to 2.4.4 Build 20260630 Rel.14398 or a later version.
  3. Update ER7206 v2 to 2.3.5 Build 20260625 Rel.43136 or a later version.
  4. Read the advisory on tp-link.com for workarounds and exact fixed builds.
  5. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
TP-LinkER7212PC v2before 2.4.3 Build 20260722 Rel.402502.4.3 Build 20260722 Rel.40250
TP-LinkER605 v2before 2.4.4 Build 20260630 Rel.143982.4.4 Build 20260630 Rel.14398
TP-LinkER7206 v2before 2.3.5 Build 20260625 Rel.431362.3.5 Build 20260625 Rel.43136
TP-LinkER7406 v1before 1.3.4 Build 20260625 Rel.431361.3.4 Build 20260625 Rel.43136
TP-LinkER707-M2 v1before 1.4.4 Build 20260625 Rel.430631.4.4 Build 20260625 Rel.43063
TP-LinkER7412-M2 v1before 1.2.0 Build 20260630 Rel.829471.2.0 Build 20260630 Rel.82947
TP-LinkER8411 v1before 1.4.1 Build 20260708 Rel.648321.4.1 Build 20260708 Rel.64832
TP-LinkER706W v1before 1.2.11 Build 20260723 Rel.415671.2.11 Build 20260723 Rel.41567
TP-Linkv1before 1.2.6 Build 20260723 Rel.413211.2.6 Build 20260723 Rel.41321
TP-LinkER706W-4G v2before 2.1.11 Build 20260723 Rel.416242.1.11 Build 20260723 Rel.41624
TP-LinkER706WP-4G v1before 1.1.11 Build 20260723 Rel.416241.1.11 Build 20260723 Rel.41624
TP-LinkER703WP-4G-Outdoor v1before 1.1.7 Build 20260723 Rel.417121.1.7 Build 20260723 Rel.41712
TP-LinkDR3220v-4G v1before 1.2.0 Build 20260630 Rel.826521.2.0 Build 20260630 Rel.82652
TP-LinkDR3650v v1before 1.2.0 Build 20260630 Rel.833111.2.0 Build 20260630 Rel.83311
TP-LinkDR3650v-4G v1before 1.2.0 Build 20260630 Rel.833471.2.0 Build 20260630 Rel.83347
TP-LinkER603WP-4G-Outdoor v1before 1.0.2 Build 20260723 Rel.432711.0.2 Build 20260723 Rel.43271
TP-LinkDR3150 v1before 1.0.1 Build 20260722 Rel.168541.0.1 Build 20260722 Rel.16854
TP-LinkER701-5G-Outdoor v1before 1.0.3 Build 20260723 Rel.409311.0.3 Build 20260723 Rel.40931
TP-LinkER605W v2before 2.0.4 Build 20260723 Rel.437632.0.4 Build 20260723 Rel.43763
TP-LinkEr7212pc Firmwarebefore 2.4.32.4.3
TP-LinkEr605 Firmwarebefore 2.4.42.4.4
TP-LinkEr605w Firmwarebefore 2.0.42.0.4
TP-LinkEr7206 Firmwarebefore 2.3.52.3.5
TP-LinkEr7406 Firmwarebefore 1.3.41.3.4
TP-LinkEr707-m2 Firmwarebefore 1.4.41.4.4

Version data comes from the organisation that assigned the CVE; 12 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 4.09.3CriticalCNA
CVSS 3.19.8CriticalNVD

Official description

A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt. Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Neutralization of Special Elements used in an OS Command

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.

How developers prevent this class of flaw

  • If at all possible, use library calls rather than external processes to recreate the desired functionality.
  • For any data that will be used to generate a command to be executed, keep as much of that data out of external control as possible. For example, in web applications, this may require storing the data locally in the session's state instead of sending it out to the client in a hidden form field.
  • For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

More Improper Neutralization of Special Elements used in an OS Command vulnerabilities (CWE-78)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Technical write-ups (may include proof of concept)

Other vulnerabilities in ER7212PC v2

All ER7212PC v2 vulnerabilities

Recent Improper Neutralization of Special Elements used in an OS Command vulnerabilities

Spotted an error? Tell us.