Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2025-6541

OS command injection using information obtained from the web management interface

Description

An arbitrary OS command may be executed on the product by the user who can log in to the web management interface.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TP-Link Systems Inc. Omada gateways

Default version status: unknown

  • 0 to < ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3affected

TP-Link Systems Inc. Festa gateways

Default version status: unaffected

  • 0 to < FR365 1.1.10, FR205 1.0.3, FR307 1.2.5affected

TP-Link Systems Inc. Omada Pro gateways

Default version status: unaffected

  • 0 to < G36 1.1.4, G611 1.2.2affected

References