TP-Link has released firmware updates for its Omada gateway devices to address four security flaws, including two rated critical that could allow arbitrary code execution on affected devices.
The issues are tracked as CVE-2025-6541 (CVSS 8.6), CVE-2025-6542 (CVSS 9.3), CVE-2025-7850 (CVSS 9.3) and CVE-2025-7851 (CVSS 8.7). Two of the flaws are operating system command injection vulnerabilities that could permit execution of arbitrary commands with different levels of access, and the fourth is an improper privilege management issue that can yield a root shell under restricted conditions.
TP-Link said the vulnerabilities affect a range of Omada gateway models and firmware builds, including ER8411 < 1.3.3 Build 20251013 Rel.44647, ER7412-M2 < 1.1.0 Build 20251015 Rel.63594, ER707-M2 < 1.3.1 Build 20251009 Rel.67687, ER7206 < 2.2.2 Build 20250724 Rel.11109, ER605 < 2.3.1 Build 20251015 Rel.78291, ER706W < 1.2.1 Build 20250821 Rel.80909, ER706W-4G < 1.2.1 Build 20250821 Rel.82492, ER7212PC < 2.1.3 Build 20251016 Rel.82571, G36 < 1.1.4 Build 20251015 Rel.84206, G611 < 1.2.2 Build 20251017 Rel.45512, FR365 < 1.1.10 Build 20250626 Rel.81746, FR205 < 1.0.3 Build 20251016 Rel.61376 and FR307-M2 < 1.2.5 Build 20251015 Rel.76743.
The vendor urged users to download and install the latest firmware to remediate the vulnerabilities and to verify device configurations after upgrading to ensure settings remain secure and aligned with their intended preferences.
TP-Link did not report any exploitation of the flaws in the wild and included a disclaimer that it cannot accept responsibility for any consequences if users do not follow the recommended actions.