TP-Link vulnerabilities
We track 251 vulnerabilities in TP-Link products across 60+ products. 250 are rated high or critical, and 6 have been exploited in real attacks. The most recent was published on November 3, 2026.
Latest TP-Link vulnerabilities
- 7.8 High severity
Tapo C260 v1: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to using the r
- 8.8 High severity
Tapo H100 v1: Improper Certificate Validation
An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept and modify encrypted device-cloud communications. This may compromise the confidentiality and integrit
- 8.0 High severity
Archer AX53 v1.0: Heap-based Buffer Overflow
Heap-based Buffer Overflow vulnerability in Archer AX53 v1.0 and AX12 v1.0 (tdpserver modules) allows adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet containing a maliciously formed
- 8.1 High severity
Archer AX53 v1.0: Key Exchange without Entity Authentication
SSH Hostkey misconfiguration vulnerability in Archer AX53 and Archer BE3600 (tmpserver modules) allows attackers to obtain device credentials through a specially crafted man‑in‑the‑middle (MITM) attack. This could enable unauthorized access if captured credent
- 8.0 High severity
Archer AX53 v1.0: Heap-based Buffer Overflow
Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet containing a field whose
- 8.0 High severity
Archer AX53 v1.0: Heap-based Buffer Overflow
Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet whose length exceeds the
- 8.0 High severity
Archer AX53 v1.0: Heap-based Buffer Overflow
Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet containing an excessive
- 8.0 High severity
Archer AX53 v1.0: Heap-based Buffer Overflow
Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet containing an excessive
- 8.0 High severity
Archer AX53 v1.0: Heap-based Buffer Overflow
Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault or potentially execute arbitrary code. The vulnerability arises from improper validation of a packet
- 8.0 High severity
Archer AX53 v1.0: Heap-based Buffer Overflow
Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet containing a field whose
- 8.0 High severity
Archer AX53 v1.0: Heap-based Buffer Overflow
Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet whose length exceeds the
- 8.0 High severity
Archer AX53 v1.0: Heap-based Buffer Overflow
Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted set of network packets containing an ex
- 7.2 High severity
Archer BE230 v1.2: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability may be exploited after the admin's authentication via the import of a crafted VPN client configuration file on the TP-Link Archer BE230 v1.2 and Deco BE25 v1.0. Successful exploitation could allow an attacker to gain full admi
- 7.2 High severity
Archer BE230 v1.2: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability may be exploited after the admin's authentication via the configuration backup restoration function of the TP-Link Archer BE230 v1.2. Successful exploitation could allow an attacker to gain full administrative control of the d
- 7.2 High severity
Archer BE230 v1.2: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability may be exploited after the admin's authentication in the VPN server configuration module on TP-Link Archer BE230 v1.2 and Archer AX73 v2. Successful exploitation could allow an attacker to gain full administrative control of t
- 7.2 High severity
Archer BE230 v1.2: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability may be exploited after the admin's authentication in the VPN Connection Service on the Archer BE230 v1.2 and Archer AXE75 v1.0. Successful exploitation could allow an attacker to gain full administrative control of the device,
- 7.2 High severity
Archer BE230 v1.2: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability may be exploited after the admin's authentication in the cloud communication interface on the TP-Link Archer BE230 v1.2. Successful exploitation could allow an attacker to gain full administrative control of the device, result
- 8.0 High severity
Archer BE230 v1.2: Improper Neutralization of Special Elements used in an OS Command
An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and BE3600 v1 (vpn modules) allows adjacent authenticated attacker execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, res
- 8.0 High severity
Archer BE230 v1.2: Improper Neutralization of Special Elements used in an OS Command
An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and Archer AXE75 v2 (web modules) allows adjacent authenticated attacker to execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the de
- 8.0 High severity
Archer BE230 v1.2: Improper Neutralization of Special Elements used in an OS Command
An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) and BE3600 v1 allows adjacent authenticated attacker execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resu
- 8.0 High severity
Archer BE230 v1.2: Improper Neutralization of Special Elements used in an OS Command
An OS Command Injection vulnerability exists in the Surfshark VPN login functionality in TP-Link Archer BE230 v1.2, BE3600v1, AX10 v3 and AXE75 v1, allowing an adjacent authenticated attacker to execute arbitrary code. Successful exploitation could allow an at
- 8.0 High severity
Archer BE230 v1.2: Improper Neutralization of Special Elements used in an OS Command
An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(web modules) and Archer AXE75 v1.0 allows adjacent authenticated attacker to execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the d
- 8.8 High severity
VIGI C485 V1: Stack-based Buffer Overflow
An authenticated buffer handling flaw in TP-Link VIGI C385 V1 Web API lacking input sanitization, may allow memory corruption leading to remote code execution. Authenticated attackers may trigger buffer overflow and potentially execute arbitrary code with elev
- 8.8 High severity
VX800v v1.0: Insufficient Entropy
A weakness in the web interface’s application layer encryption in VX800v v1.0 allows an adjacent attacker to brute force the weak AES key and decrypt intercepted traffic. Successful exploitation requires network proximity but no authentication, and may result
- 7.5 High severity
By sending crafted files to the firmware update endpoint of Tapo C220 v1 and C520WS v2, the…
By sending crafted files to the firmware update endpoint of Tapo C220 v1 and C520WS v2, the device terminates core system services before verifying authentication or firmware integrity. An unauthenticated attacker can trigger a persistent denial of service, re
- 7.5 High severity
The HTTP parser of Tapo C210 v3, C220 v1 and C520WS v2 cameras improperly handles requests…
The HTTP parser of Tapo C210 v3, C220 v1 and C520WS v2 cameras improperly handles requests containing an excessively long URL path. An invalid‑URL error path continues into cleanup code that assumes allocated buffers exist, leading to a crash and service resta
- 7.5 High severity
Tapo C220 v1: NULL Pointer Dereference
The Tapo C100 v5, C220 v1 and C520WS v2 cameras’ HTTP service does not safely handle POST requests containing an excessively large Content-Length header. The resulting failed memory allocation triggers a NULL pointer dereference, causing the main service proce
- 8.8 High severity
Archer MR600 v5.0: Improper Neutralization of Special Elements used in a Command
Command injection vulnerability was found in the admin interface component of TP-Link Archer MR600 v5 firmware, allowing authenticated attackers to execute system commands with a limited character length via crafted input in the browser developer console, poss
- 8.8 High severity
Archer C20 v6.0, Archer AX53 v1.0: Authentication Bypass by Spoofing
Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands including factory reset and device reboot without credentials. Attackers on the adj
- 8.7 High severity
VIGI InSight Sx45 Series (S245/S345/S445): Improper Authentication
Authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models allows an attacker on the LAN to reset the admin password without verification by manipulating client-side state. Attackers can gain full admin
- 7.5 High severity
TL-WR841N v14: NULL Pointer Dereference
A Null Pointer Dereference vulnerability exists in the referer header check of the web portal of TP-Link TL-WR841N v14, caused by improper input validation. A remote, unauthenticated attacker can exploit this flaw and cause Denial of Service on the web portal
- 7.3 High severity
Improper Input Validation vulnerability in TP-Link Archer AXE75 v1.6 (vpn modules) allows an…
Improper Input Validation vulnerability in TP-Link Archer AXE75 v1.6 (vpn modules) allows an authenticated adjacent attacker to delete arbitrary server file, leading to possible loss of critical system files and service interruption or degraded functionality.T
- 8.1 High severity
Tapo C200: Missing Authentication for Critical Functionality
The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in lo
- 7.5 High severity
WA850RE: Improper Authentication
Improper authentication vulnerability in TP-Link WA850RE (httpd modules) allows unauthenticated attackers to download the configuration file.This issue affects: ≤ WA850RE V2_160527, ≤ WA850RE V3_160922.
- 8.0 High severity
WA850RE: Improper Neutralization of Special Elements used in an OS Command
Command Injection vulnerability in TP-Link WA850RE (httpd modules) allows authenticated adjacent attacker to inject arbitrary commands.This issue affects: ≤ WA850RE V2_160527, ≤ WA850RE V3_160922.
- 7.0 High severity
TP-Link Tapo App: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo cameras, allowing attackers to brute force the password in the local network. Issue can be mitigated through mobile application updates. Device
- 7.0 High severity
Tapo D230S1 V1.20: Missing Authentication for Critical Functionality
The attacker may obtain root access by connecting to the UART port and this vulnerability requires the attacker to have the physical access to the device. This issue affects Tapo D230S1 V1.20: before 1.2.2 Build 20250907.
- 8.6 High severity
AX10 V1/V1.2/V2/V2.6/V3/V3.6: Buffer Copy without Checking Size of Input
An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500. The exploit can only be conducted via a Man-In-The-Middle (MITM) attack. This issue affects AX10 V1/V1.2/V2/V2.6/V3/V3.6: before 1.2.1; AX1500 V1/
- 7.2 High severity
TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Exploited
The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9. This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108. Both products hav
- 8.8 High severity
TP-Link KP303 (US) Smartplug: Missing Authentication for Critical Functionality
The TP-Link KP303 Smartplug can be issued unauthenticated protocol commands that may cause unintended power-off condition and potential information leak. This issue affects TP-Link KP303 (US) Smartplug: before 1.1.0.