CVE-2026-19586

Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways

Published Aug 20, 2026 CVSS 4.0 · 9.3 Critical EPSS 5.8% KEV · Not listed

Description

A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt.

Successful exploitation may allow arbitrary command execution, potentially
leading to full compromise of the affected device.

Analysis

Technical impact

A pre‑authentication OS command injection flaw exists in Omada gateways that run the OpenVPN Server. During the VPN connection setup an attacker may send crafted input that is not properly validated, causing back‑end command execution before authentication. The resulting remote code execution can give an attacker full control over the affected device.

Affected Systems

TP‑Link Omada gateways, including DR3150 v1, DR3220v‑4G v1, DR3650v v1, DR3650v‑4G v1, ER603WP‑4G‑Outdoor v1, ER605 v2, ER605W v2, ER701‑5G‑Outdoor v1, ER703WP‑4G‑Outdoor v1, ER706W v1, ER706W‑4G v2, ER706WP‑4G v1, ER707‑M2 v1, ER7206 v2, ER7212PC v2, ER8411 v1, ER7406 v1, and ER7412‑M2 v1.

Risk and Exploitability

The flaw carries a CVSS score of 9.3, classifying it as critically severe. The EPSS score is 5% and it is not listed in the CISA KEV catalogue, although the lack of data does not diminish the potential for exploitation. An attacker only needs to send a malicious OpenVPN packet to a device that has the OpenVPN Server feature enabled and exposed to the internet. Because the command injection occurs before authentication, no credentials are required. The upstream knowledge of the flaw means that, if a patch is not applied, the vulnerability remains a high‑risk vector for remote compromise.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

TP-Link Systems Inc.

ER7212PC v2

unaffected

Version	Status	Constraints
`0`	affected	< 2.4.3 Build 20260722 Rel.40250

TP-Link Systems Inc.

ER605 v2

unaffected

Version	Status	Constraints
`0`	affected	< 2.4.4 Build 20260630 Rel.14398

TP-Link Systems Inc.

ER7206 v2

unaffected

Version	Status	Constraints
`0`	affected	< 2.3.5 Build 20260625 Rel.43136

TP-Link Systems Inc

ER7406 v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.3.4 Build 20260625 Rel.43136

TP-Link Systems Inc.

ER707-M2 v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.4 Build 20260625 Rel.43063

TP-Link Systems Inc

ER7412-M2 v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.0 Build 20260630 Rel.82947

TP-Link Systems Inc.

ER8411 v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.1 Build 20260708 Rel.64832

TP-Link Systems Inc.

ER706W v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.11 Build 20260723 Rel.41567

TP-Link Systems Inc.

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.6 Build 20260723 Rel.41321

TP-Link Systems Inc.

ER706W-4G v2

unaffected

Version	Status	Constraints
`0`	affected	< 2.1.11 Build 20260723 Rel.41624

TP-Link Systems Inc.

ER706WP-4G v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.1.11 Build 20260723 Rel.41624

TP-Link Systems Inc.

ER703WP-4G-Outdoor v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.1.7 Build 20260723 Rel.41712

TP-Link Systems Inc.

DR3220v-4G v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.0 Build 20260630 Rel.82652

TP-Link Systems Inc.

DR3650v v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.0 Build 20260630 Rel.83311

TP-Link Systems Inc.

DR3650v-4G v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.0 Build 20260630 Rel.83347

TP-Link Systems Inc.

ER603WP-4G-Outdoor v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.0.2 Build 20260723 Rel.43271

TP-Link Systems Inc.

DR3150 v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.0.1 Build 20260722 Rel.16854

TP-Link Systems Inc.

ER701-5G-Outdoor v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.0.3 Build 20260723 Rel.40931

TP-Link Systems Inc.

ER605W v2

unaffected

Version	Status	Constraints
`0`	affected	< 2.0.4 Build 20260723 Rel.43763

Configuration 1 [-]

AND

cpe:2.3:o:tp-link:er7212pc_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er7212pc:2.0:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:tp-link:er605_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er605:2.0:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:tp-link:er605w_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er605w:2.0:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:tp-link:er7206_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er7206:2.0:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:tp-link:er7406_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er7406:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:tp-link:er707-m2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er707-m2:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:tp-link:er7412-m2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er7412-m2:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:tp-link:er8411_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er8411:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND

cpe:2.3:o:tp-link:er706w_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er706w:-:*:*:*:*:*:*:*

Configuration 10 [-]

AND

cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er706w-4g:-:*:*:*:*:*:*:*

Configuration 11 [-]

AND

cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er706w-4g:2.0:*:*:*:*:*:*:*

Configuration 12 [-]

AND

cpe:2.3:o:tp-link:er706wp-4g_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er706wp-4g:-:*:*:*:*:*:*:*

Configuration 13 [-]

AND

cpe:2.3:o:tp-link:er703wp-4g-outdoor_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er703wp-4g-outdoor:-:*:*:*:*:*:*:*

Configuration 14 [-]

AND

cpe:2.3:o:tp-link:er603wp-4g-outdoor_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er603wp-4g-outdoor:-:*:*:*:*:*:*:*

Configuration 15 [-]

AND

cpe:2.3:o:tp-link:er701-5g-outdoor_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er701-5g-outdoor:-:*:*:*:*:*:*:*

Configuration 16 [-]

AND

cpe:2.3:o:tp-link:dr3220v-4g_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:dr3220v-4g:-:*:*:*:*:*:*:*

Configuration 17 [-]

AND

cpe:2.3:o:tp-link:dr3650v_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:dr3650v:-:*:*:*:*:*:*:*

Configuration 18 [-]

AND

cpe:2.3:o:tp-link:dr3650v-4g_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:dr3650v-4g:-:*:*:*:*:*:*:*

Configuration 19 [-]

AND

cpe:2.3:o:tp-link:dr3150_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:dr3150:-:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Tp-link

Dr3150 V1

Version	Status	Scheme	Platform
`[0,1.0.1 Build 20260722 Rel.16854)`	affected	generic	—

Tp-link

Dr3220v-4g V1

Version	Status	Scheme	Platform
`[0,1.2.0 Build 20260630 Rel.82652)`	affected	generic	—

Tp-link

Dr3650v-4g V1

Version	Status	Scheme	Platform
`[0,1.2.0 Build 20260630 Rel.83347)`	affected	generic	—

Tp-link

Dr3650v V1

Version	Status	Scheme	Platform
`[0,1.2.0 Build 20260630 Rel.83311)`	affected	generic	—

Tp-link

Er603wp-4g-outdoor V1

Version	Status	Scheme	Platform
`[0,1.0.2 Build 20260723 Rel.43271)`	affected	generic	—

Tp-link

Er605 V2

Version	Status	Scheme	Platform
`[0,2.4.4 Build 20260630 Rel.14398)`	affected	generic	—

Tp-link

Er605w V2

Version	Status	Scheme	Platform
`[0,2.0.4 Build 20260723 Rel.43763)`	affected	generic	—

Tp-link

Er701-5g-outdoor

Version	Status	Scheme	Platform
`[0,1.0.3 Build 20260723 Rel.40931)`	affected	generic	—

Tp-link

Er703wp-4g-outdoor

Version	Status	Scheme	Platform
`[0,1.1.7 Build 20260723 Rel.41712)`	affected	generic	—

Tp-link

Er706w-4g V2

Version	Status	Scheme	Platform
`[0,2.1.11 Build 20260723 Rel.41624)`	affected	generic	—

Tp-link

Er706w V1

Version	Status	Scheme	Platform
`[0,1.2.11 Build 20260723 Rel.41567)`	affected	generic	—

Tp-link

Er706wp-4g V1

Version	Status	Scheme	Platform
`[0,1.1.11 Build 20260723 Rel.41624)`	affected	generic	—

Tp-link

Er707-m2 V1

Version	Status	Scheme	Platform
`[0,1.4.4 Build 20260625 Rel.43063)`	affected	generic	—

Tp-link

Er7206 V2

Version	Status	Scheme	Platform
`[0,2.3.5 Build 20260625 Rel.43136)`	affected	generic	—

Tp-link

Er7212pc V2

Version	Status	Scheme	Platform
`[0,2.4.3 Build 20260722 Rel.40250)`	affected	generic	—

Tp-link

Er7406 V1

Version	Status	Scheme	Platform
`[0,1.3.4 Build 20260625 Rel.43136)`	affected	generic	—

Tp-link

Er8411 V1

Version	Status	Scheme	Platform
`[0,1.4.1 Build 20260708 Rel.64832)`	affected	generic	—

Tp-link

Version	Status	Scheme	Platform
`[0,1.2.6 Build 20260723 Rel.41321)`	affected	generic	—

Tp-link Systems Inc

Er7412-m2 V1

Version	Status	Scheme	Platform
`[0,1.2.0 Build 20260630 Rel.82947)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest firmware update from TP‑Link or Omada support to close the command injection flaw.
If a firmware update is not immediately available, disable the OpenVPN Server feature on affected devices to eliminate the attack surface.
Restrict inbound VPN traffic to trusted IP addresses by configuring firewall rules that block or limit port 1194/UDP, reducing exposure.

Generated by OpenCVE AI on August 21, 2026 at 14:39 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 5.8% (5.772% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://mattg.systems/posts/cve-2026-19586/
https://www.omadanetworks.com/en/support/download/
https://www.omadanetworks.com/us/support/download/
https://www.tp-link.com/us/support/faq/5256/

History

Sep 3, 2026 3:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Tp-link dr3150 Tp-link dr3150 Firmware Tp-link dr3220v-4g Tp-link dr3220v-4g Firmware Tp-link dr3650v Tp-link dr3650v-4g Tp-link dr3650v-4g Firmware Tp-link dr3650v Firmware Tp-link er603wp-4g-outdoor Tp-link er603wp-4g-outdoor Firmware Tp-link er605 Tp-link er605 Firmware Tp-link er605w Tp-link er605w Firmware Tp-link er701-5g-outdoor Firmware Tp-link er703wp-4g-outdoor Firmware Tp-link er706w Tp-link er706w-4g Tp-link er706w-4g Firmware Tp-link er706w Firmware Tp-link er706wp-4g Tp-link er706wp-4g Firmware Tp-link er707-m2 Tp-link er707-m2 Firmware Tp-link er7206 Tp-link er7206 Firmware Tp-link er7212pc Tp-link er7212pc Firmware Tp-link er7406 Tp-link er7406 Firmware Tp-link er7412-m2 Tp-link er7412-m2 Firmware Tp-link er8411 Tp-link er8411 Firmware
CPEs		cpe:2.3:h:tp-link:dr3150:-:::::::* cpe:2.3:h:tp-link:dr3220v-4g:-:::::::* cpe:2.3:h:tp-link:dr3650v-4g:-:::::::* cpe:2.3:h:tp-link:dr3650v:-:::::::* cpe:2.3:h:tp-link:er603wp-4g-outdoor:-:::::::* cpe:2.3:h:tp-link:er605:2.0:::::::* cpe:2.3:h:tp-link:er605w:2.0:::::::* cpe:2.3:h:tp-link:er701-5g-outdoor:-:::::::* cpe:2.3:h:tp-link:er703wp-4g-outdoor:-:::::::* cpe:2.3:h:tp-link:er706w-4g:-:::::::* cpe:2.3:h:tp-link:er706w-4g:2.0:::::::* cpe:2.3:h:tp-link:er706w:-:::::::* cpe:2.3:h:tp-link:er706wp-4g:-:::::::* cpe:2.3:h:tp-link:er707-m2:-:::::::* cpe:2.3:h:tp-link:er7206:2.0:::::::* cpe:2.3:h:tp-link:er7212pc:2.0:::::::* cpe:2.3:h:tp-link:er7406:-:::::::* cpe:2.3:h:tp-link:er7412-m2:-:::::::* cpe:2.3:h:tp-link:er8411:-:::::::* cpe:2.3:o:tp-link:dr3150_firmware:::::::: cpe:2.3:o:tp-link:dr3220v-4g_firmware:::::::: cpe:2.3:o:tp-link:dr3650v-4g_firmware:::::::: cpe:2.3:o:tp-link:dr3650v_firmware:::::::: cpe:2.3:o:tp-link:er603wp-4g-outdoor_firmware:::::::: cpe:2.3:o:tp-link:er605_firmware:::::::: cpe:2.3:o:tp-link:er605w_firmware:::::::: cpe:2.3:o:tp-link:er701-5g-outdoor_firmware:::::::: cpe:2.3:o:tp-link:er703wp-4g-outdoor_firmware:::::::: cpe:2.3:o:tp-link:er706w-4g_firmware:::::::: cpe:2.3:o:tp-link:er706w_firmware:::::::: cpe:2.3:o:tp-link:er706wp-4g_firmware:::::::: cpe:2.3:o:tp-link:er707-m2_firmware:::::::: cpe:2.3:o:tp-link:er7206_firmware:::::::: cpe:2.3:o:tp-link:er7212pc_firmware:::::::: cpe:2.3:o:tp-link:er7406_firmware:::::::: cpe:2.3:o:tp-link:er7412-m2_firmware:::::::: cpe:2.3:o:tp-link:er8411_firmware::::::::
Vendors & Products		Tp-link dr3150 Tp-link dr3150 Firmware Tp-link dr3220v-4g Tp-link dr3220v-4g Firmware Tp-link dr3650v Tp-link dr3650v-4g Tp-link dr3650v-4g Firmware Tp-link dr3650v Firmware Tp-link er603wp-4g-outdoor Tp-link er603wp-4g-outdoor Firmware Tp-link er605 Tp-link er605 Firmware Tp-link er605w Tp-link er605w Firmware Tp-link er701-5g-outdoor Firmware Tp-link er703wp-4g-outdoor Firmware Tp-link er706w Tp-link er706w-4g Tp-link er706w-4g Firmware Tp-link er706w Firmware Tp-link er706wp-4g Tp-link er706wp-4g Firmware Tp-link er707-m2 Tp-link er707-m2 Firmware Tp-link er7206 Tp-link er7206 Firmware Tp-link er7212pc Tp-link er7212pc Firmware Tp-link er7406 Tp-link er7406 Firmware Tp-link er7412-m2 Tp-link er7412-m2 Firmware Tp-link er8411 Tp-link er8411 Firmware
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Aug 28, 2026 7:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://mattg.systems/posts/cve-2026-19586/

Aug 21, 2026 1:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Tp-link Tp-link dr3150 V1 Tp-link dr3220v-4g V1 Tp-link dr3650v-4g V1 Tp-link dr3650v V1 Tp-link er603wp-4g-outdoor V1 Tp-link er605 V2 Tp-link er605w V2 Tp-link er701-5g-outdoor Tp-link er703wp-4g-outdoor Tp-link er706w-4g V2 Tp-link er706w V1 Tp-link er706wp-4g V1 Tp-link er707-m2 V1 Tp-link er7206 V2 Tp-link er7212pc V2 Tp-link er7406 V1 Tp-link er8411 V1 Tp-link v1 Tp-link Systems Inc Tp-link Systems Inc er7412-m2 V1
Vendors & Products		Tp-link Tp-link dr3150 V1 Tp-link dr3220v-4g V1 Tp-link dr3650v-4g V1 Tp-link dr3650v V1 Tp-link er603wp-4g-outdoor V1 Tp-link er605 V2 Tp-link er605w V2 Tp-link er701-5g-outdoor Tp-link er703wp-4g-outdoor Tp-link er706w-4g V2 Tp-link er706w V1 Tp-link er706wp-4g V1 Tp-link er707-m2 V1 Tp-link er7206 V2 Tp-link er7212pc V2 Tp-link er7406 V1 Tp-link er8411 V1 Tp-link v1 Tp-link Systems Inc Tp-link Systems Inc er7412-m2 V1

Aug 20, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 20, 2026 7:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt. Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device.
Title		Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways
Weaknesses		CWE-78
References		https://www.omadanetworks.com/en/support/download/ https://www.omadanetworks.com/us/support/download/ https://www.tp-link.com/us/support/faq/5256/
Metrics		cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L'}`

Subscriptions

Tp-link Dr3150 Dr3150 Firmware Dr3150 V1 Dr3220v-4g Dr3220v-4g Firmware Dr3220v-4g V1 Dr3650v Dr3650v-4g Dr3650v-4g Firmware Dr3650v-4g V1 Dr3650v Firmware Dr3650v V1 Er603wp-4g-outdoor Er603wp-4g-outdoor Firmware Er603wp-4g-outdoor V1 Er605 Er605 Firmware Er605 V2 Er605w Er605w Firmware Er605w V2 Er701-5g-outdoor Er701-5g-outdoor Firmware Er703wp-4g-outdoor Er703wp-4g-outdoor Firmware Er706w Er706w-4g Er706w-4g Firmware Er706w-4g V2 Er706w Firmware Er706w V1 Er706wp-4g Er706wp-4g Firmware Er706wp-4g V1 Er707-m2 Er707-m2 Firmware Er707-m2 V1 Er7206 Er7206 Firmware Er7206 V2 Er7212pc Er7212pc Firmware Er7212pc V2 Er7406 Er7406 Firmware Er7406 V1 Er7412-m2 Er7412-m2 Firmware Er8411 Er8411 Firmware Er8411 V1 V1

Tp-link Systems Inc Er7412-m2 V1

Weaknesses