TP-Link vulnerabilities
We track 251 vulnerabilities in TP-Link products across 60+ products. 250 are rated high or critical, and 6 have been exploited in real attacks. The most recent was published on November 3, 2026.
Latest TP-Link vulnerabilities
- 8.8 High severity
AX1800: Stack-based Buffer Overflow
TP-Link AX1800 Firmware Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AX1800 routers. Authentication is not required
- 8.8 High severity
Archer AX21: Stack-based Buffer Overflow
TP-Link Archer AX21 tdpServer Logging Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer AX21 routers. Authentication is no
- 8.8 High severity
AC1350 Wireless MU-MIMO Gigabit Access Point…: Out-of-bounds Write
A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote cod
- 8.8 High severity
AC1350 Wireless MU-MIMO Gigabit Access Point…: Out-of-bounds Write
A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote cod
- 8.8 High severity
AC1350 Wireless MU-MIMO Gigabit Access Point…: Out-of-bounds Write
A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote cod
- 8.8 High severity
AC1350 Wireless MU-MIMO Gigabit Access Point…: Out-of-bounds Write
A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote cod
- 8.8 High severity
AC1350 Wireless MU-MIMO Gigabit Access Point…: Out-of-bounds Write
A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote cod
- 8.8 High severity
AC1350 Wireless MU-MIMO Gigabit Access Point…: Out-of-bounds Write
A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote cod
- 8.8 High severity
AC1350 Wireless MU-MIMO Gigabit Access Point…: Out-of-bounds Write
A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote cod
- 8.8 High severity
AC1350 Wireless MU-MIMO Gigabit Access Point…: Out-of-bounds Write
A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote cod
- 9.8 Critical severity
AC1350 Wireless MU-MIMO Gigabit Access Point…: Improper Neutralization of Special Elements used in a Command
A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point (EAP115 V4) v5.0.4 Build 20220216. A specially
- 9.8 Critical severity
AC1350 Wireless MU-MIMO Gigabit Access Point…: Improper Neutralization of Special Elements used in a Command
A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point (EAP115 V4) v5.0.4 Build 20220216. A specially
- 7.5 High severity
AC1350 Wireless MU-MIMO Gigabit Access Point…: Exposed Dangerous Method or Function
A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of network requests can lead to reset to factory settings. An attacker can
- 7.5 High severity
AC1350 Wireless MU-MIMO Gigabit Access Point…: Out-of-bounds Write
A memory corruption vulnerability exists in the web interface functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted HTTP POST request can lead to denial of service of the device's web inter
- 8.0 High severity
Omada ER605: Improper Neutralization of Special Elements used in an OS Command
TP-Link Omada ER605 Access Control Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605. Authentication is required to exploit thi
- 8.8 High severity
Omada ER605: Out-of-bounds Write
TP-Link Omada ER605 DHCPv6 Client Options Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication i
- 9.8 Critical severity
TP-Link EX20v AX1800, Tp-Link Archer C5v…: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TP-Link TP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD-W9970, Tp-Link TD-W9970v3, TP-Link VX220-G2u, TP-Link VN020-G2u allows authenticated
- 10.0 Critical severity
omada_er605: Buffer Copy without Checking Size of Input
In TP-Link Omada er605 1.0.1 through (v2.6) 2.2.3, a cloud-brd binary is susceptible to an integer overflow that leads to a heap-based buffer overflow. After heap shaping, an attacker can achieve code execution in the context of the cloud-brd binary that runs
- 8.8 High severity
tl-sg2210p: Improper Access Control
TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201 allows attackers to escalate privileges via modification of the 'tid' and 'usrlvl' values in GET requests.
- 7.2 High severity
ER7206 Omada Gigabit VPN Router: Improper Neutralization of Special Elements used in an OS Command
A post authentication command execution vulnerability exists in the web filtering functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can
- 7.2 High severity
ER7206 Omada Gigabit VPN Router: Improper Neutralization of Special Elements used in an OS Command
A post authentication command injection vulnerability exists when configuring the web group member of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker
- 7.2 High severity
ER7206 Omada Gigabit VPN Router: Improper Neutralization of Special Elements used in an OS Command
A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can
- 7.2 High severity
ER7206 Omada Gigabit VPN Router: Improper Neutralization of Special Elements used in an OS Command
A post authentication command injection vulnerability exists in the GRE policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can ma
- 7.2 High severity
ER7206 Omada Gigabit VPN Router: Improper Neutralization of Special Elements used in an OS Command
A post authentication command injection vulnerability exists when configuring the wireguard VPN functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection .
- 7.2 High severity
ER7206 Omada Gigabit VPN Router: Improper Neutralization of Special Elements used in an OS Command
A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authentica
- 7.2 High severity
ER7206 Omada Gigabit VPN Router: Improper Neutralization of Special Elements used in an OS Command
A post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An a
- 7.2 High severity
ER7206 Omada Gigabit VPN Router: Improper Neutralization of Special Elements used in an OS Command
A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can m
- 8.8 High severity
Archer AX3000: Improper Neutralization of Special Elements used in an OS Command
Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi.
- 8.0 High severity
Archer AX3000: Improper Neutralization of Special Elements used in an OS Command
Multiple TP-LINK products allow a network-adjacent authenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commands.
- 8.8 High severity
Archer AX3000: Improper Neutralization of Special Elements used in an OS Command
Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commands on the product that has pre-specified target devices and blocked URLs in parental control setting
- 9.8 Critical severity
tl-wr886n_firmware: Out-of-bounds Write
TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin and TL-WDR7660 2.0.30 was discovered to contain a stack overflow via the function bindRequestHandle.
- 9.8 Critical severity
tl-wr886n_firmware: Out-of-bounds Write
TP-LINK device TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin and TL-WDR7660 2.0.30 were discovered to contain a stack overflow via the function deviceInfoRegister.
- 7.5 High severity
Mini Smart Wi-fi Plug Firmware: Incorrect Permission Assignment for Critical Resource
Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42, switchBot Hub2 v.1.0-0.8, Phillips hue hub v.1.59.1959097030, and yeelight smart lamp v.1.12.69 allo
- 9.8 Critical severity
er5120g: Missing Authorization
There is an unauthorized access vulnerability in TP-LINK ER5120G 4.0 2.0.0 Build 210817 Rel.80868n, which allows attackers to obtain sensitive information of the device without authentication, obtain user tokens, and ultimately log in to the device backend man
- 8.8 High severity
tl-er5120g: Improper Neutralization of Special Elements used in a Command
TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds NAPT rules after authentication, and the rule name has an injection point.
- 8.8 High severity
tl-er5120g: Improper Neutralization of Special Elements used in a Command
TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds ACL rules after authentication, and the rule name parameter has injection points.
- 8.0 High severity
Archer AX6000: Improper Neutralization of Special Elements used in an OS Command
Archer AX6000 firmware versions prior to 'Archer AX6000(JP)_V1_1.3.0 Build 20221208' allows a network-adjacent authenticated attacker to execute arbitrary OS commands.
- 8.0 High severity
Archer AX50: Improper Neutralization of Special Elements used in an OS Command
Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer AX50 firmware versions prior to 'Archer AX50(JP)_V1_230529', Archer A10 firmware versions prior to 'Ar
- 8.0 High severity
Deco M4: Improper Neutralization of Special Elements used in an OS Command
Deco M4 firmware versions prior to 'Deco M4(JP)_V2_1.5.8 Build 20230619' allows a network-adjacent authenticated attacker to execute arbitrary OS commands.
- 8.0 High severity
Archer C5400: Improper Neutralization of Special Elements used in an OS Command
Archer C5400 firmware versions prior to 'Archer C5400(JP)_V2_230506' allows a network-adjacent authenticated attacker to execute arbitrary OS commands.