TP-Link vulnerabilities
We track 251 vulnerabilities in TP-Link products across 60+ products. 250 are rated high or critical, and 6 have been exploited in real attacks. The most recent was published on November 3, 2026.
Latest TP-Link vulnerabilities
- 7.5 High severity
TL-WR841N V11: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/Wan6to4TunnelCfgRpm.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the web service and result in a
- 7.5 High severity
TL-WR841N V11: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WzdWlanSiteSurveyRpm_AP.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the web service and result i
- 7.5 High severity
TL-WR841N V11: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WlanNetworkRpm_APC.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the web service and result in a d
- 7.5 High severity
TL-WR841N V11: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in TP-Link TL-WR841N V11. The vulnerability exists in the /userRpm/WlanNetworkRpm_AP.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the web service and result in a de
- 7.5 High severity
TL-WR841N v11: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in TP-Link TL-WR841N v11, TL-WR842ND v2 and TL-WR494N v3. The vulnerability exists in the /userRpm/WlanNetworkRpm.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the w
- 8.7 High severity
VIGI NVR1104H-4P V1: Improper Neutralization of Special Elements used in an OS Command
An unauthenticated OS command injection vulnerability exists in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1: before 1.1.5 Build 250518; VIGI NVR2016H-16MP V2: before 1.3.1 Build 250407.
- 8.5 High severity
VIGI NVR1104H-4P V1: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability exists that can be exploited after authentication in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1: before 1.1.5 Build 250518; VIGI NVR2016H-16MP V2: before 1.3.1 Build 250407.
- 8.2 High severity
TL-WR940N V4: Buffer Copy without Checking Size of Input
A vulnerability has been found in TP-Link TL-WR940N V4 and TL-WR841N V11. Affected by this issue is some unknown functionality of the file /userRpm/WanSlaacCfgRpm.htm, which may lead to buffer overflow. The attack may be launched remotely. This vulnerability o
- 8.8 High severity
TL-IPC544EP-W4: Buffer Copy without Checking Size of Input
A vulnerability classified as critical has been found in TP-LINK Technologies TL-IPC544EP-W4 1.0.9 Build 240428 Rel 69493n. Affected is the function sub_69064 of the file /bin/main. The manipulation of the argument text leads to buffer overflow. It is possible
- 9.2 Critical severity
Link Archer AX50: Stack-based Buffer Overflow
Stack-based buffer overflow vulnerability in the 'conn-indicator' binary running as root on the TP-Link Archer AX50 router, in firmware versions prior to 1.0.15 build 241203 rel61480. This vulnerability allows an attacker to execute arbitrary code on the devic
- 8.0 High severity
Deco BE65 Pro: Improper Neutralization of Special Elements used in an OS Command
OS command injection vulnerability exists in Deco BE65 Pro firmware versions prior to "Deco BE65 Pro(JP)_V1_1.1.2 Build 20250123". If this vulnerability is exploited, an arbitrary OS command may be executed by the user who can log in to the device.
- 9.8 Critical severity
Tl-wr845n Firmware: Use of Hard-coded Credentials
TP-Link TL-WR845N devices with firmware TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 was discovered to contain a hardcoded password for the root account which can be obtained by analyzing downloaded firmware or via a brute force attack through physical
- 7.5 High severity
Tl-wr841nd Firmware: Out-of-bounds Write
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11, triggered by the dnsserver1 and dnsserver2 parameters at /userRpm/WanSlaacCfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- 7.5 High severity
Tl-wr841nd Firmware: Out-of-bounds Write
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the pskSecret parameter at /userRpm/WlanSecurityRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- 7.5 High severity
Tl-wr841nd Firmware: Out-of-bounds Write
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the 'ip' parameter at /userRpm/WanStaticIpV6CfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- 7.0 High severity
Tapo C500 V1 Wi-Fi Camera: Use of Hard-coded Cryptographic Key
This vulnerability exists in Tapo C500 Wi-Fi camera due to hard-coded RSA private key embedded within the device firmware. An attacker with physical access could exploit this vulnerability to obtain cryptographic private keys which can then be used to perform
- 8.0 High severity
Tl-wpa8630 Firmware: Improper Neutralization of Special Elements used in an OS Command
An issue in TPLINK TL-WPA 8630 TL-WPA8630(US)_V2_2.0.4 Build 20230427 allows a remote attacker to execute arbitrary code via function sub_4256CC, which allows command injection by injecting 'devpwd'.
- 8.0 High severity
Tl-wr940n Firmware: Buffer Copy without Checking Size of Input
TP-Link TL-WR940N V3 and V4 with firmware 3.16.9 and earlier contain a buffer overflow via the dnsserver1 and dnsserver2 parameters at /userRpm/Wan6to4TunnelCfgRpm.htm. This vulnerability allows an authenticated attacker to execute arbitrary code on the remote
- 8.0 High severity
Tl-wr845n Firmware: Insufficiently Protected Credentials
TP-Link TL-WR845N(UN)_V4_190219 was discovered to transmit credentials in base64 encoded form, which can be easily decoded by an attacker executing a man-in-the-middle attack.
- 9.8 Critical severity
Tl-wr845n Firmware: Cleartext Storage of Sensitive Information
TL-WR845N(UN)_V4_201214, TP-Link TL-WR845N(UN)_V4_200909, and TL-WR845N(UN)_V4_190219 was discovered to transmit user credentials in plaintext after executing a factory reset.
- 8.0 High severity
Tl-wr845n Firmware: Insufficiently Protected Credentials
TP-Link TL-WR845N(UN)_V4_201214, TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 were discovered to contain weak default credentials for the Administrator account.
- 9.8 Critical severity
VN020 F3v(T): Out-of-bounds Write
A vulnerability, which was classified as critical, was found in TP-Link VN020 F3v(T) TT_V6.2.1021. This affects an unknown part of the component FTP USER Command Handler. The manipulation leads to memory corruption. It is possible to initiate the attack remote
- 8.8 High severity
VN020 F3v(T): Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability classified as critical has been found in TP-Link VN020 F3v(T) TT_V6.2.1021. Affected is an unknown function of the file /control/WANIPConnection of the component SOAP Request Handler. The manipulation of the argument NewConnectionType leads to
- 8.5 High severity
Archer C50 Wireless Router: Improper Verification of Cryptographic Signature
This vulnerability exists in the TP-Link Archer C50 due to improper signature verification mechanism in the firmware upgrade process at its web interface. An attacker with administrative privileges within the router’s Wi-Fi range could exploit this vulnerabili
- 8.0 High severity
archer_axe75_firmware: Improper Neutralization of Special Elements used in an OS Command
An Authenticated Remote Code Execution (RCE) vulnerability affects the TP-Link Archer router series. A vulnerability exists in the "tmp_get_sites" function of the HomeShield functionality provided by TP-Link. This vulnerability is still exploitable without the
- 8.0 High severity
tl-ipc42c_firmware: Improper Neutralization of Special Elements used in a Command
TP-Link TL-IPC42C V4.0_20211227_1.0.16 is vulnerable to command injection due to the lack of malicious code verification on both the frontend and backend.
- 9.8 Critical severity
VN020 F3v(T): Out-of-bounds Write
A vulnerability, which was classified as critical, has been found in TP-Link VN020 F3v(T) TT_V6.2.1021. Affected by this issue is some unknown functionality of the component DHCP DISCOVER Packet Parser. The manipulation of the argument hostname leads to stack-
- 7.5 High severity
tl-mr200_v4_firmware: NULL Pointer Dereference
TP Link MR200 V4 Firmware version 210201 was discovered to contain a null-pointer-dereference in the web administration panel on /cgi/login via the sign, Action or LoginStatus query parameters which could lead to a denial of service by a local or remote unauth
- 9.8 Critical severity
re365: Out-of-bounds Write
In the TP-Link RE365 V1_180213, there is a buffer overflow vulnerability due to the lack of length verification for the USER_AGENT field in /usr/bin/httpd. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or exe
- 7.2 High severity
ER7206 Omada Gigabit VPN Router: Active Debug Code
A leftover debug code vulnerability exists in the cli_server debug functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.4.1 Build 20240117 Rel.57421. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can
- 8.8 High severity
Archer C4500X: Improper Neutralization of Special Elements used in a Command
The affected device expose a network service called "rftest" that is vulnerable to unauthenticated command injection on ports TCP/8888, TCP/8889, and TCP/8890. By successfully exploiting this flaw, remote unauthenticated attacker can gain arbitrary command exe
- 7.5 High severity
Omada ER605: Buffer Copy without Checking Size of Input
TP-Link Omada ER605 Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vul
- 7.5 High severity
Omada ER605: Stack-based Buffer Overflow
TP-Link Omada ER605 Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to expl
- 7.5 High severity
Omada ER605: Heap-based Buffer Overflow
TP-Link Omada ER605 Comexe DDNS Response Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentic
- 7.5 High severity
Omada ER605: Improper Neutralization of Special Elements used in an OS Command
TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required
- 6.5 Medium severity
TP-Link TL-WR841N Authentication Bypass by Spoofing Exploited
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not req
- 8.0 High severity
Tapo C210: Out-of-bounds Write
TP-Link Tapo C210 ActiveCells Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Tapo C210 IP cameras. Although authentication is
- 8.8 High severity
TL-WR841N: Improper Neutralization of Special Elements used in a Command
TP-Link TL-WR841N ated_tp Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit th
- 8.8 High severity
Tapo C210: Weak Password Recovery Mechanism for Forgotten Password
TP-Link Tapo C210 Password Recovery Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of TP-Link Tapo C210 IP cameras. Authentication is not required to exploit this vul
- 8.1 High severity
AX1800: Concurrent Execution using Shared Resource with Improper Synchronization
TP-Link AX1800 hotplugd Firewall Rule Race Condition Vulnerability. This vulnerability allows remote attackers to gain access to LAN-side services on affected installations of TP-Link Archer AX21 routers. Authentication is not required to exploit this vulnerab