TP-Link vulnerabilities
We track 251 vulnerabilities in TP-Link products across 60+ products. 250 are rated high or critical, and 6 have been exploited in real attacks. The most recent was published on November 3, 2026.
Latest TP-Link vulnerabilities
- 7.3 High severity
Archer AX3000 v2: Improper Neutralization of Special Elements used in an OS Command
An authenticated OS command injection vulnerability exists in the Offline Download component (USB storage allocation) of Archer AX3000 v2. When a USB storage device is attached, an authenticated administrator can submit a crafted path value containing shell me
- 8.3 High severity
Tapo Cloud Service: Server-Side Request Forgery
The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a user-controlled host value without sufficient input validation. An attacker may exploit this vulnerability to cause the Tapo Cloud service to send reques
- 8.3 High severity
Tapo Cloud Service: Missing Authorization
The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo devices to request service tokens. The broker does not verify that the device ID supplied in a proxy request belongs to the authenticated devi
- 8.7 High severity
RE305 v3: Improper Neutralization of Special Elements used in an OS Command
An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets and access privileged TD
- 7.1 High severity
Tapo C210 v3.6: Improper Authentication
TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an administrative password, a
- 8.5 High severity
Tapo C320WS v2: Stack-based Buffer Overflow
Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path. An authenticated attacker on the adjacent network can submit a crafted request containing an oversized encrypted password field, overwrite
- 7.5 High severity
Omada Software Controller: Improper Access Control
Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. Successful exploitation may allow a low-pri
- 8.7 High severity
HS103 v5: Missing Authentication for Critical Functionality
Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorization, allowi
- 8.7 High severity
Tapo C325WB v2: Use of Insufficiently Random Values
TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number generator, making the key predictable and recoverable. An unauthenticated attacker on the adjacent network can recover the key
- 7.1 High severity
Tapo C325WB v2: Stack-based Buffer Overflow
An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Account feature is enabled. A crafted pair of RTSP-over-HTTP tunneling requests can cause memory corruption and crash the
- 8.7 High severity
Tapo C325WB v2: Improper Authentication
TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification
- 7.1 High severity
Tapo C500 v2.0: Use of Out-of-range Pointer Offset
TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in a denial-of-service con
- 7.7 High severity
Deco M9 Plus V2: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request data length before it is copied into a fixed-size stack buffer in the subtype 0x91 handler. Successful
- 7.7 High severity
Archer AX90 v1: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device bo
- 7.1 High severity
Tapo C200 V5: NULL Pointer Dereference
Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not validate that a password field is present for certain authentication
- 7.1 High severity
Tapo C200 v5: Missing Authentication for Critical Functionality
Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup. An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt connection
- 8.7 High severity
Tapo C200 v5: Improper Authentication
Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative se
- 7.7 High severity
Deco BE11000 V2: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. Successful exploitation may lead to complete devic
- 8.5 High severity
RE210 AC750: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability exists in the httpd component of RE210 AC750 due to improper bounds checking in the splitString function when processing an uploaded configuration file. An authenticated attacker on the local network can upload a cra
- 7.7 High severity
Archer AX55 v4: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution o
- 8.7 High severity
TL-MR100 v3.20: Stack-based Buffer Overflow
A pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt function of TL-MR100 V3.20 due to insufficient bounds checking of encrypted requests to the /cgi/login endpoint. An adjacent unauthenticated attacker with access to
- 8.7 High severity
HS103P3 / HS103P4 v5: Missing Cryptographic Step
Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially resulting in unautho
- 8.5 High severity
Archer BE3600 v1: Improper Neutralization of Special Elements used in an OS Command
A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processe
- 8.7 High severity
Archer BE800 V1: Improper Neutralization of Special Elements used in an OS Command
An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inj
- 8.5 High severity
Archer BE800 v1: Improper Neutralization of Special Elements used in an OS Command
An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation
- 7.7 High severity
Deco XE75 v3 / XE5300 v3.6/ WE10800 v3.6: Use of Hard-coded Cryptographic Key
The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. A shared RSA-512 mesh group private key is present in the affected firmware and is used by the mesh protocol for
- 7.1 High severity
TL-MR6400 v7.0: Out-of-bounds Write
A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially cr
- 7.1 High severity
TL-MR6400 v7.0: NULL Pointer Dereference
A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header
- 8.5 High severity
TL-MR6400 v7.0: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability exists in the firmware update functionality of TL-MR6400 v7 due to unsafe processing of attacker-controlled metadata within a firmware image. Successful exploitation may allow an authenticated attacker to trigger mem
- 7.4 High severity
ER7212PC v2: Cleartext Transmission of Sensitive Information
A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate tr
- 9.8 Critical severity
ER7212PC v2: Improper Neutralization of Special Elements used in an OS Command
A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote a
- 7.5 High severity
TL-MR100 v3.2: NULL Pointer Dereference
An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference. A remote atta
- 8.8 High severity
Tapo C200 v5: Improper Authentication
Tapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification module. An attacker on the local network can exploit weaknesses in challenge parameter validation to bypass normal authentication controls an
- 8.6 High severity
HB810(US2) V1.0/1.6/2.0/2.6: Improper Neutralization of Special Elements used in an OS Command
Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input t
- 8.5 High severity
HB810(US2) V1.0/1.6/2.0/2.6: Use of Hard-coded Cryptographic Key
In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation
- 8.6 High severity
HB810(US2) V1.0/1.6/2.0/2.6: Incorrect Authorization
In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critic
- 8.7 High severity
HB810(US2) V1.0/1.6/2.0/2.6: Missing Authorization
The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke priv
- 7.5 High severity
P110 v1: Buffer Copy without Checking Size of Input
Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient input validation before memory copy operations. This may lead to buffer overflow condition, causing th
- 7.5 High severity
Omada Gateways: Insufficient Entropy
A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed devices may be predictable due to insufficient entropy in session key generation. An attacker who succes
- 7.5 High severity
Omada Gateways: Use of Hard-coded Credentials
Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices. An attacker who obtains the embedded certificates may be able to impersonate trusted controllers or devices and