https://vulnogram.org/ Most recent CVEs assigned by TP-Link Systems Inc. (tplink). https://vulnogram.org/seaview/icons/tplink.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-105815 https://vulnogram.org/CVE-2026-105815 TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an administrative p… High Mon, 19 Oct 2026 21:27:02 GMT https://vulnogram.org/CVE-2026-105814 https://vulnogram.org/CVE-2026-105814 TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied in… Medium Mon, 19 Oct 2026 21:26:57 GMT https://vulnogram.org/CVE-2026-105810 https://vulnogram.org/CVE-2026-105810 Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path. An authenticated attacker on the adjacent network can submit a crafted request containing an oversized encrypted password field,… High Mon, 19 Oct 2026 17:46:42 GMT https://vulnogram.org/CVE-2026-107795 https://vulnogram.org/CVE-2026-107795 Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. Successful exploitation may allow… High Wed, 14 Oct 2026 22:26:50 GMT https://vulnogram.org/CVE-2026-102298 https://vulnogram.org/CVE-2026-102298 In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses t… High Wed, 14 Oct 2026 21:55:10 GMT https://vulnogram.org/CVE-2026-109506 https://vulnogram.org/CVE-2026-109506 Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture the network traffic associated with legitim… Medium Wed, 14 Oct 2026 18:31:37 GMT https://vulnogram.org/CVE-2026-108473 https://vulnogram.org/CVE-2026-108473 Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorizati… High Wed, 14 Oct 2026 00:06:08 GMT https://vulnogram.org/CVE-2026-105674 https://vulnogram.org/CVE-2026-105674 TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number generator, making the key predictable and recoverable. An unauthenticated attacker on the adjacent network can recov… High Thu, 08 Oct 2026 22:21:45 GMT https://vulnogram.org/CVE-2026-105672 https://vulnogram.org/CVE-2026-105672 TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session ver… High Thu, 08 Oct 2026 22:21:34 GMT https://vulnogram.org/CVE-2026-105673 https://vulnogram.org/CVE-2026-105673 An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Account feature is enabled. A crafted pair of RTSP-over-HTTP tunneling requests can cause memory corruption and… High Thu, 08 Oct 2026 22:21:28 GMT https://vulnogram.org/CVE-2026-102368 https://vulnogram.org/CVE-2026-102368 Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physical access to an affected device can recover this sensitive material from the firmware. Successful exploitation… Medium Thu, 08 Oct 2026 20:54:25 GMT https://vulnogram.org/CVE-2026-104945 https://vulnogram.org/CVE-2026-104945 TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit an excessive number of preset-related elements, causing writes beyond the bounds of fixed-size stack a… Medium Tue, 06 Oct 2026 18:41:13 GMT https://vulnogram.org/CVE-2026-104944 https://vulnogram.org/CVE-2026-104944 TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in a denial-of-s… High Tue, 06 Oct 2026 18:40:58 GMT https://vulnogram.org/CVE-2026-102370 https://vulnogram.org/CVE-2026-102370 Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloader. Although the debug traces are physically severed during manufacturing, an attacker with physical access can… Medium Thu, 01 Oct 2026 20:47:30 GMT https://vulnogram.org/CVE-2026-84682 https://vulnogram.org/CVE-2026-84682 A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during… High Thu, 01 Oct 2026 18:48:42 GMT https://vulnogram.org/CVE-2026-8618 https://vulnogram.org/CVE-2026-8618 A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request data length before it is copied into a fixed-size stack buffer in the subtype 0x91 handler. S… High Thu, 01 Oct 2026 18:16:32 GMT https://vulnogram.org/CVE-2026-102369 https://vulnogram.org/CVE-2026-102369 Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an adminis… High Thu, 01 Oct 2026 17:42:25 GMT https://vulnogram.org/CVE-2026-78578 https://vulnogram.org/CVE-2026-78578 Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup. An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt c… High Thu, 01 Oct 2026 17:42:05 GMT https://vulnogram.org/CVE-2026-78577 https://vulnogram.org/CVE-2026-78577 Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. After initial setup, an unauthenticated attacker on the same local network can invoke the scan action and retrieve nearby wireless a… Medium Thu, 01 Oct 2026 17:41:49 GMT https://vulnogram.org/CVE-2026-9032 https://vulnogram.org/CVE-2026-9032 Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not validate that a password field is present for certain authe… High Thu, 01 Oct 2026 17:41:31 GMT https://vulnogram.org/CVE-2026-102294 https://vulnogram.org/CVE-2026-102294 TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary… High Thu, 01 Oct 2026 17:30:19 GMT https://vulnogram.org/CVE-2026-84941 https://vulnogram.org/CVE-2026-84941 An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied… Medium Thu, 10 Sep 2026 23:35:53 GMT https://vulnogram.org/CVE-2026-17176 https://vulnogram.org/CVE-2026-17176 An OS command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. Successful exploitation may lead to comp… High Thu, 10 Sep 2026 23:14:33 GMT https://vulnogram.org/CVE-2026-76652 https://vulnogram.org/CVE-2026-76652 An authenticated directory traversal vulnerability in file upload functionality has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8. Due to insufficient validation of user-supplied file information, an authenticated remote attacker wit… Medium Thu, 10 Sep 2026 20:12:50 GMT https://vulnogram.org/CVE-2026-76653 https://vulnogram.org/CVE-2026-76653 A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN confi… Medium Thu, 10 Sep 2026 20:12:43 GMT https://vulnogram.org/CVE-2026-85384 https://vulnogram.org/CVE-2026-85384 A stack-based buffer overflow vulnerability exists in the httpd component of RE210 AC750 due to improper bounds checking in the splitString function when processing an uploaded configuration file. An authenticated attacker on the local network can up… High Unsupported When Assigned Tue, 08 Sep 2026 18:43:58 GMT https://vulnogram.org/CVE-2026-81531 https://vulnogram.org/CVE-2026-81531 An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users.… Medium Network Exploitable Tue, 08 Sep 2026 16:53:18 GMT https://vulnogram.org/CVE-2026-18167 https://vulnogram.org/CVE-2026-18167 A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code e… High Thu, 03 Sep 2026 22:24:57 GMT https://vulnogram.org/CVE-2026-18330 https://vulnogram.org/CVE-2026-18330 A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known shared RSA private key to decrypt the administrator password; the weakened AES sessio… Medium Thu, 03 Sep 2026 22:24:45 GMT https://vulnogram.org/CVE-2026-75118 https://vulnogram.org/CVE-2026-75118 A pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt function of TL-MR100 V3.20 due to insufficient bounds checking of encrypted requests to the /cgi/login endpoint. An adjacent unauthenticated attacker with… High Fri, 28 Aug 2026 20:31:03 GMT https://vulnogram.org/CVE-2026-76651 https://vulnogram.org/CVE-2026-76651 A buffer overflow vulnerability exists in the embedded HTTP service in TL-WR841N v14 when processing multipart/form-data requests. Insufficient validation of an attacker-controlled boundary parameter may allow a remote unauthenticated attacker to sub… Medium Fri, 28 Aug 2026 20:19:09 GMT https://vulnogram.org/CVE-2026-76650 https://vulnogram.org/CVE-2026-76650 A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP state variable query requests. A specially crafted SOAP query may trigger unexpected termination or instability of the process hosting the UPnP… Medium Fri, 28 Aug 2026 20:19:03 GMT https://vulnogram.org/CVE-2026-76649 https://vulnogram.org/CVE-2026-76649 A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP action requests. A specially crafted SOAP action request containing unexpected XML content may cause the UPnP daemon to terminate unexpectedly.… Medium Fri, 28 Aug 2026 20:18:57 GMT https://vulnogram.org/CVE-2026-76784 https://vulnogram.org/CVE-2026-76784 Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local device communication protocol. An adjacent network attacker may intercept, replay or forge locally exchanged control messages, potentially resulting… High Wed, 26 Aug 2026 17:47:54 GMT https://vulnogram.org/CVE-2026-78541 https://vulnogram.org/CVE-2026-78541 A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is late… High Mon, 24 Aug 2026 18:26:11 GMT https://vulnogram.org/CVE-2026-16348 https://vulnogram.org/CVE-2026-16348 An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exp… High Mon, 24 Aug 2026 17:25:46 GMT https://vulnogram.org/CVE-2026-9254 https://vulnogram.org/CVE-2026-9254 An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attack… High Mon, 24 Aug 2026 17:25:30 GMT https://vulnogram.org/CVE-2026-15469 https://vulnogram.org/CVE-2026-15469 The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. A shared RSA-512 mesh group private key is present in the affected firmware and is used by the mesh pro… High Mon, 24 Aug 2026 16:32:12 GMT https://vulnogram.org/CVE-2026-17252 https://vulnogram.org/CVE-2026-17252 A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a sp… High Fri, 21 Aug 2026 17:16:51 GMT https://vulnogram.org/CVE-2026-17251 https://vulnogram.org/CVE-2026-17251 A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session coo… High Fri, 21 Aug 2026 17:16:45 GMT https://vulnogram.org/CVE-2026-17250 https://vulnogram.org/CVE-2026-17250 A stack-based buffer overflow vulnerability exists in the firmware update functionality of TL-MR6400 v7 due to unsafe processing of attacker-controlled metadata within a firmware image. Successful exploitation may allow an authenticated attacker to t… High Fri, 21 Aug 2026 17:16:38 GMT https://vulnogram.org/CVE-2026-19683 https://vulnogram.org/CVE-2026-19683 A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or man… Medium Network Exploitable Thu, 20 Aug 2026 18:32:27 GMT https://vulnogram.org/CVE-2026-19586 https://vulnogram.org/CVE-2026-19586 A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticate… Critical Network Exploitable Thu, 20 Aug 2026 18:32:06 GMT https://vulnogram.org/CVE-2026-9033 https://vulnogram.org/CVE-2026-9033 An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authe… Medium Thu, 20 Aug 2026 18:31:54 GMT https://vulnogram.org/CVE-2026-8619 https://vulnogram.org/CVE-2026-8619 An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference. A r… High Wed, 19 Aug 2026 23:11:51 GMT https://vulnogram.org/CVE-2026-75616 https://vulnogram.org/CVE-2026-75616 An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute a… High Wed, 19 Aug 2026 20:44:11 GMT https://vulnogram.org/CVE-2026-75619 https://vulnogram.org/CVE-2026-75619 Tapo C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, resulting in out-of-bounds heap w… Medium Wed, 19 Aug 2026 18:30:59 GMT https://vulnogram.org/CVE-2026-75618 https://vulnogram.org/CVE-2026-75618 Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and d… High Wed, 19 Aug 2026 18:30:50 GMT https://vulnogram.org/CVE-2026-15316 https://vulnogram.org/CVE-2026-15316 An improper input validation vulnerability in the configuration service for processing encrypted credential data has been identified in Tapo C200 v5. An attacker can send oversized crypted ciphertext values that may trigger exception handling failure… High Tue, 18 Aug 2026 21:25:11 GMT https://vulnogram.org/CVE-2026-15315 https://vulnogram.org/CVE-2026-15315 Tapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification module. An attacker on the local network can exploit weaknesses in challenge parameter validation to bypass normal authentication c… High Tue, 18 Aug 2026 21:24:59 GMT