8.8

CVE-2025-6541

Medienbericht

OS command injection using information obtained from the web management interface

An arbitrary OS command may be executed on the product by the user who can log in to the web management interface.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tp-link ≫ Er706w Firmware Version < 1.2.1
   Tp-link ≫ Er706w Version -
Tp-link ≫ Er706w Firmware Version 1.2.1 Update -
   Tp-link ≫ Er706w Version -
Tp-link ≫ Er706w-4g Firmware Version < 1.2.1
   Tp-link ≫ Er706w-4g Version -
Tp-link ≫ Er706w-4g Firmware Version 1.2.1 Update -
   Tp-link ≫ Er706w-4g Version -
Tp-link ≫ Er7212pc Firmware Version < 2.1.3
   Tp-link ≫ Er7212pc Version -
Tp-link ≫ Er7212pc Firmware Version 2.1.3 Update -
   Tp-link ≫ Er7212pc Version -
Tp-link ≫ G36 Firmware Version < 1.1.4
   Tp-link ≫ G36 Version -
Tp-link ≫ G36 Firmware Version 1.1.4 Update -
   Tp-link ≫ G36 Version -
Tp-link ≫ G611 Firmware Version < 1.2.2
   Tp-link ≫ G611 Version -
Tp-link ≫ G611 Firmware Version 1.2.2 Update -
   Tp-link ≫ G611 Version -
Tp-link ≫ Fr365 Firmware Version < 1.1.10
   Tp-link ≫ Fr365 Version -
Tp-link ≫ Fr365 Firmware Version 1.1.10 Update -
   Tp-link ≫ Fr365 Version -
Tp-link ≫ Fr205 Firmware Version < 1.0.3
   Tp-link ≫ Fr205 Version -
Tp-link ≫ Fr205 Firmware Version 1.0.3 Update -
   Tp-link ≫ Fr205 Version -
Tp-link ≫ Fr307-m2 Firmware Version < 1.2.5
   Tp-link ≫ Fr307-m2 Version -
Tp-link ≫ Fr307-m2 Firmware Version 1.2.5 Update -
   Tp-link ≫ Fr307-m2 Version -
Tp-link ≫ Er8411 Firmware Version < 1.3.3
   Tp-link ≫ Er8411 Version -
Tp-link ≫ Er8411 Firmware Version 1.3.3 Update -
   Tp-link ≫ Er8411 Version -
Tp-link ≫ Er7412-m2 Firmware Version < 1.1.0
   Tp-link ≫ Er7412-m2 Version -
Tp-link ≫ Er7412-m2 Firmware Version 1.1.0 Update -
   Tp-link ≫ Er7412-m2 Version -
Tp-link ≫ Er707-m2 Firmware Version < 1.3.1
   Tp-link ≫ Er707-m2 Version -
Tp-link ≫ Er707-m2 Firmware Version 1.3.1 Update -
   Tp-link ≫ Er707-m2 Version -
Tp-link ≫ Er7206 Firmware Version < 2.2.2
   Tp-link ≫ Er7206 Version -
Tp-link ≫ Er7206 Firmware Version 2.2.2 Update -
   Tp-link ≫ Er7206 Version -
Tp-link ≫ Er605 Firmware Version < 2.3.1
   Tp-link ≫ Er605 Version -
Tp-link ≫ Er605 Firmware Version 2.3.1 Update -
   Tp-link ≫ Er605 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.66% 0.473
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
f23511db-6c3e-4e32-a477-6aa17d310630 8.6 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
22.10.2025 13:29
https://support.omadanetworks.com/en/document/108455/
Vendor Advisory
https://www.omadanetworks.com/us/business-networking/all-omada-router/
Product
https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/
Product
https://www.tp-link.com/us/business-networking/soho-festa-gateway/
Product