CVE-2025-6542 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
TPLink	CNA	---				---
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 30%

Vendor	Product	Version
tp-link	er8411_firmware	𝑥 < 1.3.3
tp-link	er8411_firmware	1.3.3
tp-link	er7412-m2_firmware	𝑥 < 1.1.0
tp-link	er7412-m2_firmware	1.1.0
tp-link	er707-m2_firmware	𝑥 < 1.3.1
tp-link	er707-m2_firmware	1.3.1
tp-link	er7206_firmware	𝑥 < 2.2.2
tp-link	er7206_firmware	2.2.2
tp-link	er605_firmware	𝑥 < 2.3.1
tp-link	er605_firmware	2.3.1
tp-link	er706w_firmware	𝑥 < 1.2.1
tp-link	er706w_firmware	1.2.1
tp-link	er706w-4g_firmware	𝑥 < 1.2.1
tp-link	er706w-4g_firmware	1.2.1
tp-link	er7212pc_firmware	𝑥 < 2.1.3
tp-link	er7212pc_firmware	2.1.3
tp-link	g36_firmware	𝑥 < 1.1.4
tp-link	g36_firmware	1.1.4
tp-link	g611_firmware	𝑥 < 1.2.2
tp-link	g611_firmware	1.2.2
tp-link	fr365_firmware	𝑥 < 1.1.10
tp-link	fr365_firmware	1.1.10
tp-link	fr205_firmware	𝑥 < 1.0.3
tp-link	fr205_firmware	1.0.3
tp-link	fr307-m2_firmware	𝑥 < 1.2.5
tp-link	fr307-m2_firmware	1.2.5

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References

https://support.omadanetworks.com/en/document/108455/

https://www.omadanetworks.com/us/business-networking/all-omada-router/

https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/

https://www.tp-link.com/us/business-networking/soho-festa-gateway/