TP-Hyperlink Patches 4 Omada Gateway Flaws, Two Enable Distant Code Execution

Oct 22, 2025Ravie LakshmananVulnerability / Community Safety

TP-Hyperlink has launched safety updates to handle 4 safety flaws impacting Omada gateway gadgets, together with two crucial bugs that would end in arbitrary code execution.

The vulnerabilities in query are listed under –

• CVE-2025-6541 (CVSS rating: 8.6) – An working system command injection vulnerability that might be exploited by an attacker who can log in to the net administration interface to run arbitrary instructions
• CVE-2025-6542 (CVSS rating: 9.3) – An working system command injection vulnerability that might be exploited by a distant unauthenticated attacker to run arbitrary instructions
• CVE-2025-7850 (CVSS rating: 9.3) – An working system command injection vulnerability that might be exploited by an attacker in possession of an administrator password of the net portal to run arbitrary instructions
• CVE-2025-7851 (CVSS rating: 8.7) – An improper privilege administration vulnerability that might be exploited by an attacker to acquire the basis shell on the underlying working system underneath restricted circumstances

“Attackers could execute arbitrary instructions on the machine’s underlying working system,” TP-Hyperlink mentioned in an advisory launched Tuesday.

The problems influence the next product fashions and variations –

• ER8411 < 1.3.3 Construct 20251013 Rel.44647
• ER7412-M2 < 1.1.0 Construct 20251015 Rel.63594
• ER707-M2 < 1.3.1 Construct 20251009 Rel.67687
• ER7206 < 2.2.2 Construct 20250724 Rel.11109
• ER605 < 2.3.1 Construct 20251015 Rel.78291
• ER706W < 1.2.1 Construct 20250821 Rel.80909
• ER706W-4G < 1.2.1 Construct 20250821 Rel.82492
• ER7212PC < 2.1.3 Construct 20251016 Rel.82571
• G36 < 1.1.4 Construct 20251015 Rel.84206
• G611 < 1.2.2 Construct 20251017 Rel.45512
• FR365 < 1.1.10 Construct 20250626 Rel.81746
• FR205 < 1.0.3 Construct 20251016 Rel.61376
• FR307-M2 < 1.2.5 Construct 20251015 Rel.76743

Whereas TP-Hyperlink makes no point out of the failings being exploited within the wild, it is suggested that customers transfer rapidly to obtain and replace to the newest firmware to repair the vulnerabilities.

“Verify the configurations of the machine after the firmware improve to make sure that all settings stay correct, safe, and aligned with their meant preferences,” it added.

It additionally famous in a disclaimer that it can’t bear any accountability for any penalties which will come up if the aforementioned really helpful actions aren’t adhered to.