TPLink

Latest CVEs · RSS

• CVE-2026-107795 2026-10-14 · CVSS 7.5
  Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user
• CVE-2026-102298 2026-10-14 · CVSS 7.5
  In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlle
• CVE-2026-109506 2026-10-14 · CVSS 5.9
  Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated atta
• CVE-2026-108473 2026-10-14 · CVSS 8.7
  Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send ma
• CVE-2026-105674 2026-10-08 · CVSS 8.7
  TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number generator, making the key
• CVE-2026-105672 2026-10-08 · CVSS 8.7
  TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjac
• CVE-2026-105673 2026-10-08 · CVSS 7.1
  An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Account feature is ena
• CVE-2026-102368 2026-10-08 · CVSS 5.4
  Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physical access to an affe
• CVE-2026-104945 2026-10-06 · CVSS 6.8
  TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit an excessive
• CVE-2026-104944 2026-10-06 · CVSS 7.1
  TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram ca
• CVE-2026-102370 2026-10-01 · CVSS 5.4
  Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloader.  Although the deb
• CVE-2026-84682 2026-10-01 · CVSS 7.7
  A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the s
• CVE-2026-8618 2026-10-01 · CVSS 7.7
  A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request dat
• CVE-2026-102369 2026-10-01 · CVSS 8.7
  Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticat
• CVE-2026-78578 2026-10-01 · CVSS 7.1
  Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup.  An unauthenticated adjacent attacker
• CVE-2026-78577 2026-10-01 · CVSS 5.3
  Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. After initial setup, an unauthenticated at
• CVE-2026-9032 2026-10-01 · CVSS 7.1
  Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser.  The interface is reachable without authentication a
• CVE-2026-102294 2026-10-01 · CVSS 8.5
  TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorpo
• CVE-2026-84941 2026-09-10 · CVSS 6.9
  An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration
• CVE-2026-17176 2026-09-10 · CVSS 7.7
  An OS command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an adjacent network attacker to execute arbitrary commands with
• CVE-2026-76652 2026-09-10 · CVSS 4.8
  An authenticated directory traversal vulnerability in file upload functionality has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8. Due to insuf
• CVE-2026-76653 2026-09-10 · CVSS 5.3
  A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper ac
• CVE-2026-85384 2026-09-08 · CVSS 8.5
  A stack-based buffer overflow vulnerability exists in the httpd component of RE210 AC750 due to improper bounds checking in the splitString function when proces
• CVE-2026-81531 2026-09-08 · CVSS 6.9
  An information disclosure vulnerability has been identified in Omada Controller.  An API endpoint intended for Controller initialization remains accessible afte
• CVE-2026-18167 2026-09-03 · CVSS 7.7
  A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafte