TP-Hyperlink Patches 4 Omada Gateway Flaws, Two Permit Distant Code Execution

Oct 22, 2025Ravie LakshmananVulnerability / Community Safety

TP-Hyperlink has launched safety updates to deal with 4 safety flaws impacting Omada gateway gadgets, together with two crucial bugs that might end in arbitrary code execution.

The vulnerabilities in query are listed under –

• CVE-2025-6541 (CVSS rating: 8.6) – An working system command injection vulnerability that may very well be exploited by an attacker who can log in to the net administration interface to run arbitrary instructions
• CVE-2025-6542 (CVSS rating: 9.3) – An working system command injection vulnerability that may very well be exploited by a distant unauthenticated attacker to run arbitrary instructions
• CVE-2025-7850 (CVSS rating: 9.3) – An working system command injection vulnerability that may very well be exploited by an attacker in possession of an administrator password of the net portal to run arbitrary instructions
• CVE-2025-7851 (CVSS rating: 8.7) – An improper privilege administration vulnerability that may very well be exploited by an attacker to acquire the foundation shell on the underlying working system below restricted situations

“Attackers might execute arbitrary instructions on the machine’s underlying working system,” TP-Hyperlink mentioned in an advisory launched Tuesday.

The problems affect the next product fashions and variations –

• ER8411 < 1.3.3 Construct 20251013 Rel.44647
• ER7412-M2 < 1.1.0 Construct 20251015 Rel.63594
• ER707-M2 < 1.3.1 Construct 20251009 Rel.67687
• ER7206 < 2.2.2 Construct 20250724 Rel.11109
• ER605 < 2.3.1 Construct 20251015 Rel.78291
• ER706W < 1.2.1 Construct 20250821 Rel.80909
• ER706W-4G < 1.2.1 Construct 20250821 Rel.82492
• ER7212PC < 2.1.3 Construct 20251016 Rel.82571
• G36 < 1.1.4 Construct 20251015 Rel.84206
• G611 < 1.2.2 Construct 20251017 Rel.45512
• FR365 < 1.1.10 Construct 20250626 Rel.81746
• FR205 < 1.0.3 Construct 20251016 Rel.61376
• FR307-M2 < 1.2.5 Construct 20251015 Rel.76743

Whereas TP-Hyperlink makes no point out of the failings being exploited within the wild, it is suggested that customers transfer rapidly to obtain and replace to the newest firmware to repair the vulnerabilities.

“Verify the configurations of the machine after the firmware improve to make sure that all settings stay correct, safe, and aligned with their meant preferences,” it added.

It additionally famous in a disclaimer that it can not bear any duty for any penalties which will come up if the aforementioned really useful actions are usually not adhered to.