CVE-2025-7850
High
Description
A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.
SeverityHigh
CVSS7.2
Exploit probability—
Product
Tp-link Er8411 Firmware
PublishedOct 21, 2025
First seenOct 21, 2025
Weakness typeCWE-78OS command injection
How to fix
Update
- tp-link er8411_firmware1.3.3 or later
- tp-link er7412-m2_firmware1.1.0 or later
- tp-link er707-m2_firmware1.3.1 or later
- tp-link er7206_firmware2.2.2 or later
- tp-link er605_firmware2.3.1 or later
- tp-link er706w_firmware1.2.1 or later
- tp-link er706w-4g_firmware1.2.1 or later
- tp-link er7212pc_firmware2.1.3 or later
- tp-link g36_firmware1.1.4 or later
- tp-link g611_firmware1.2.2 or later
- tp-link fr365_firmware1.1.10 or later
- tp-link fr205_firmware1.0.3 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tp-link er8411_firmware | v < 1.3.3, 1.3.3 | 1.3.3 |
| tp-link er7412-m2_firmware | v < 1.1.0, 1.1.0 | 1.1.0 |
| tp-link er707-m2_firmware | v < 1.3.1, 1.3.1 | 1.3.1 |
| tp-link er7206_firmware | v < 2.2.2, 2.2.2 | 2.2.2 |
| tp-link er605_firmware | v < 2.3.1, 2.3.1 | 2.3.1 |
| tp-link er706w_firmware | v < 1.2.1, 1.2.1 | 1.2.1 |
| tp-link er706w-4g_firmware | v < 1.2.1, 1.2.1 | 1.2.1 |
| tp-link er7212pc_firmware | v < 2.1.3, 2.1.3 | 2.1.3 |
| tp-link g36_firmware | v < 1.1.4, 1.1.4 | 1.1.4 |
| tp-link g611_firmware | v < 1.2.2, 1.2.2 | 1.2.2 |
| tp-link fr365_firmware | v < 1.1.10, 1.1.10 | 1.1.10 |
| tp-link fr205_firmware | v < 1.0.3, 1.0.3 | 1.0.3 |
| tp-link fr307-m2_firmware | v < 1.2.5, 1.2.5 | 1.2.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.