TP-Link System Inc. vulnerabilities

Products

• TL-WR841N v14 4
• Archer BE230 v1.2 1
• Archer C1200 1
• Omada Software Controller 1
• Omada Software Controller (Windows) 1
• Tapo S505 v1.6 1
• TL-WR940N V6 1

Latest TP-Link System Inc. CVEs

Newest publication first

1. CVE-2026-102298 Insufficient Authorization and User Boundary Validation in Omada Controller MSP

   Published 2026-10-14

   High·CVSS 7.5 EPSS 0.44%

   In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent us...

2. CVE-2026-102368 Plaintext Storage of a Device-Specific Private Key in Tapo S505 Firmware

   Published 2026-10-08

   Medium·CVSS 5.4 EPSS 0.10%

   Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physical access to an affected device can recover this sensitive material from the firmware. Successful exploitation of this vulnerability may res...

3. CVE-2026-102294 Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration

   Published 2026-10-01

   High·CVSS 8.5 EPSS 0.95%

   TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands. Suc...

4. CVE-2026-81531 Unauthenticated Account Information Disclosure in Multiple Omada Controllers

   Published 2026-09-08

   Medium·CVSS 6.9 EPSS 0.67%

   An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users. Successful exploitation may al...

5. CVE-2026-76651 Pre-Authentication Multipart Boundary Buffer Overflow in HTTP Service in TP-Link TL-WR841N

   Published 2026-08-28

   Medium·CVSS 5.3 EPSS 0.44%

   A buffer overflow vulnerability exists in the embedded HTTP service in TL-WR841N v14 when processing multipart/form-data requests. Insufficient validation of an attacker-controlled boundary parameter may allow a remote unauthenticated attacker to submit a crafted request that cor...

6. CVE-2026-76650 Pre-Authentication NULL Pointer Dereference in UPnP SOAP State Variable Query Processing in TP-Link TL-WR841N

   Published 2026-08-28

   Medium·CVSS 5.3 EPSS 0.27%

   A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP state variable query requests. A specially crafted SOAP query may trigger unexpected termination or instability of the process hosting the UPnP service. Successful exploitati...

7. CVE-2026-76649 Pre-Authentication NULL Pointer Dereference in UPnP SOAP Action Request Processing in TP-Link TL-WR841N

   Published 2026-08-28

   Medium·CVSS 5.3 EPSS 0.27%

   A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP action requests. A specially crafted SOAP action request containing unexpected XML content may cause the UPnP daemon to terminate unexpectedly. Successful exploitation may re...

8. CVE-2026-22223 Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and BE3600 v1

   Published 2026-02-02

   High·CVSS 8.5 EPSS 1.4%

   An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and BE3600 v1 (vpn modules) allows adjacent authenticated attacker execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe com...

9. CVE-2025-11676 UPnP DOS in TL-WR940N V6

   Published 2025-11-20

   High·CVSS 7.1 EPSS 0.21%

   Improper input validation vulnerability in TP-Link System Inc. TL-WR940N V6 (UPnP modules), which allows unauthenticated adjacent attackers to perform DoS attack. This issue affects TL-WR940N V6 <= Build 220801.

10. CVE-2025-6983 Clickjacking vulnerability on the management web application of TP-LINK Archer C1200

    Published 2025-07-16

    Medium·CVSS 5.1 EPSS 0.46%

    A Clickjacking vulnerability in TP-Link Archer C1200 web management page allows an attacker to trick users into performing unintended actions via rendered UI layers or frames.This issue affects Archer C1200 <= 1.1.5.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.