TP-Link System vulnerabilities
We track 4 vulnerabilities in TP-Link System products across 4 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
Latest TP-Link System vulnerabilities
- 7.5 High severity
Omada Software Controller (Windows): Authorization Bypass Through User-Controlled Key
In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distin
- 8.5 High severity
TL-WR841N v14: Improper Neutralization of Special Elements used in an OS Command
TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating
- 8.0 High severity
Archer BE230 v1.2: Improper Neutralization of Special Elements used in an OS Command
An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and BE3600 v1 (vpn modules) allows adjacent authenticated attacker execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, res
- 7.1 High severity
Improper input validation vulnerability in TP-Link System Inc.
Improper input validation vulnerability in TP-Link System Inc. TL-WR940N V6 (UPnP modules), which allows unauthenticated adjacent attackers to perform DoS attack. This issue affects TL-WR940N V6 <= Build 220801.