Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2025-6542

OS command injection in multiple parameters

Description

An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TP-Link Systems Inc. Omada gateways

Default version status: unknown

  • 0 to < ER8411 1.3.3, ER7412-M2 1.1.0, ER707-M2 1.3.1, ER7206 2.2.2, ER605 2.3.1, ER706W 1.2.1, ER706W-4G 1.2.1, ER7212PC 2.1.3affected

TP-Link Systems Inc. Festa gateways

Default version status: unaffected

  • 0 to < FR365 1.1.10, FR205 1.0.3, FR307 1.2.5affected

TP-Link Systems Inc. Omada Pro gateways

Default version status: unaffected

  • 0 to < G36 1.1.4, G611 1.2.2affected

References