TP-Link Systems Inc. vulnerabilities

Published CVEs affecting TP-Link Systems Inc. products: 193 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2025-14175 Medium · 6.5 CWE-327 Dec 29, 2025

Weak Algorithm Support in SSH Server on TL-WR820N

A vulnerability in the SSH server of TP-Link TL-WR820N v2.80 allows the use of a weak cryptographic algorithm, enabling an adjacent attacker to intercept and decrypt SSH traffic. Exploitation may expose sensitive information and compromise confidentiality.

CVE-2025-8065 Medium · 6.5 CWE-120 Dec 19, 2025

Remote Code Execution via Stack-based Buffer Overflow in ONVIF SOAP Parser in TP-Link Tapo C200 and C520WS

A stack-based buffer overflow vulnerability was identified in the ONVIF SOAP XML Parser in Tapo C200 v3 and C520WS v2.6. When processing XML tags with namespace prefixes, the parser fails to validate the prefix length before copying it to a fixed-size stack buffer. It allowed a crafted SOAP request with an oversized namespace prefix to cause memory corruption in stack. An unauthenticated attacker on the same local network may exploit this flaw to enable remote code execution with elevated privileges, leading to full compromise of the device.

CVE-2025-14300 High · 8.1 CWE-306 Dec 19, 2025

Unauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C425

The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in loss of connectivity and denial-of-service (DoS).

CVE-2025-14299 Medium · 6.5 CWE-190 Dec 19, 2025

Improper Content-Length Validation in HTTPS Requests on Tapo C200

The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on the same local network segment can send crafted HTTPS requests to trigger excessive memory allocation, causing the device to crash and resulting in denial-of-service (DoS).

CVE-2025-14739 Medium · 6.8 CWE-824 Dec 18, 2025

Uninitialized Pointer Vulnerability in TP-Link WR940N and WR941ND

Access of Uninitialized Pointer vulnerability in TP-Link WR940N and WR941ND allows local unauthenticated attackers the ability to execute DoS attack and potentially arbitrary code execution under the context of the ‘root’ user.This issue affects WR940N and WR941ND: ≤ WR940N v5 3.20.1 Build 200316, ≤ WR941ND v6 3.16.9 Build 151203.

CVE-2025-14738 High · 7.5 CWE-287 Dec 18, 2025

Configuration Disclosure Vulnerability in TP-Link WA850RE

Improper authentication vulnerability in TP-Link WA850RE (httpd modules) allows unauthenticated attackers to download the configuration file.This issue affects: ≤ WA850RE V2_160527, ≤ WA850RE V3_160922.

CVE-2025-14737 High · 8.0 CWE-78 Dec 18, 2025

Command Injection Vulnerability in TP-Link WA850RE

Command Injection vulnerability in TP-Link WA850RE (httpd modules) allows authenticated adjacent attacker to inject arbitrary commands.This issue affects: ≤ WA850RE V2_160527, ≤ WA850RE V3_160922.

CVE-2025-14553 High · 7.0 CWE-200 Dec 16, 2025

Password Hash Leak Could Lead to Unauthorized Access on Tapo App via Local Network

Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo cameras, allowing attackers to brute force the password in the local network. Issue can be mitigated through mobile application updates. Device firmware remains unchanged.

CVE-2025-7851 Critical · 9.8 CWE-269 Oct 20, 2025

Unauthorized root access via debug functionality

An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.

CVE-2025-7850 High · 7.2 CWE-78 Oct 20, 2025

Authenticated OS command execution

A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.

CVE-2025-6542 Critical · 9.8 CWE-78 Oct 20, 2025

OS command injection in multiple parameters

An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.

CVE-2025-6541 High · 8.8 CWE-78 Oct 20, 2025

OS command injection using information obtained from the web management interface

An arbitrary OS command may be executed on the product by the user who can log in to the web management interface.

CVE-2025-9377 High · 7.2 KEV High · 56 CWE-78 Aug 29, 2025

TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability

The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9. This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108. Both products have reached the status of EOL (end-of-life). It's recommending to purchase the new product to ensure better performance and security. If replacement is not an option in the short term, please use the second reference link to download and install the patch(es).

CVE-2023-50224 Medium · 6.5 KEV High · 53 CWE-290 May 3, 2024

TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.

CVE-2023-33538 High · 8.8 KEV High · 65 Public exploit CWE-77 Jun 7, 2023

TP-Link Multiple Routers Command Injection Vulnerability

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .

CVE-2023-1389 High · 8.8 KEV Urgent · 77 Public exploit CWE-77 Mar 15, 2023

TP-Link Archer AX-21 Command Injection Vulnerability

TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.

CVE-2020-24363 High · 8.8 KEV High · 64 Public exploit CWE-306 Aug 31, 2020

TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability

TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password.

CVE-2015-3035 High · 7.5 KEV Urgent · 75 Public exploit CWE-22 Apr 21, 2015

TP-Link Multiple Archer Devices Directory Traversal Vulnerability

Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.